EUVD-2026-37940
GHSA-w78p-vwm4-m8q9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low complexity; requires an authenticated low-privileged user with write access to a search-path directory (PR:L), no user interaction, and full CIA impact in the affected user's context with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.
AnalysisAI
Local privilege escalation and arbitrary code execution affects Yandex Punto Switcher through version 4.5.0.583 due to an unquoted search path passed to WinExec when launching RunDll32.exe to invoke shell32.dll's Control_RunDLL with input.dll. An authenticated local attacker who can drop an executable into an earlier directory in the Windows search order can hijack execution and run code in the context of the affected user. No public exploit identified at time of analysis, but the technique (CWE-428) is well-understood and trivially weaponized.
Technical ContextAI
Punto Switcher is a popular Russian-language automatic keyboard-layout switcher published by Yandex (CPE cpe:2.3:a:yandex:punto_switcher:*). The flaw is an unquoted/untrusted search path issue (CWE-428): the application invokes the Win32 WinExec API with a command line that references RunDll32.exe without a fully qualified path, so WinExec resolves the binary using the standard Windows executable search order (application directory, current directory, %PATH%, etc.) rather than %SystemRoot%\System32\rundll32.exe. Because RunDll32 is then used to load shell32.dll's Control_RunDLL entrypoint with input.dll, an attacker who can write to any directory that precedes System32 in that resolution order can substitute a malicious rundll32.exe and gain code execution when Punto Switcher invokes the call.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the Yandex product page at https://yandex.ru/soft/punto and the VulnCheck advisory at https://www.vulncheck.com/advisories/punto-switcher-unquoted-search-path-via-winexec for an updated build above 4.5.0.583 and upgrade as soon as one is released. As a compensating control, audit and tighten the Windows %PATH% for any user-writable directories that precede %SystemRoot%\System32 and remove or ACL-restrict them (side effect: may break tools that rely on PATH-resident binaries), and ensure Punto Switcher's installation directory and the current working directory it inherits at launch are not writable by standard users. Application allow-listing (e.g. Windows Defender Application Control or AppLocker) restricting which rundll32.exe binaries may execute under the user's session will block hijacked copies, at the cost of additional policy maintenance; if Punto Switcher is non-essential, uninstalling it is the most decisive mitigation.
Same weakness CWE-428 – Unquoted Search Path or Element
View allShare
External POC / Exploit Code
Leaving vuln.today