EUVD-2026-15190
GHSA-mc38-gw9c-q8f5
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary code with the privileges of the user invoking the installer.
AnalysisAI
A DLL hijacking vulnerability exists in the installer for OM Workspace (Windows Edition) Ver 2.4 and earlier, allowing local attackers to execute arbitrary code with the privileges of the user running the installer. The vulnerability is reported by JPCERT and affects software from OM Digital Solutions Corporation. With a CVSS score of 7.8 (High), the vulnerability requires local access and user interaction but no special privileges, making it a moderate real-world risk for targeted attacks during software installation.
Technical ContextAI
This vulnerability stems from CWE-427 (Uncontrolled Search Path Element), commonly known as DLL hijacking or binary planting. The affected product is OM Workspace (Windows Edition) from OM Digital Solutions Corporation, as identified by CPE cpe:2.3:a:om_digital_solutions_corporation:om_workspace_(windows_edition):*:*:*:*:*:*:*:*. During installation, the installer does not properly specify the full path when loading Dynamic Link Libraries, instead relying on the Windows DLL search order. This allows an attacker to place a malicious DLL in a directory that Windows will search before the legitimate location (such as the current working directory or other user-writable locations). When the installer loads what it expects to be a legitimate system DLL, it instead loads and executes the attacker's malicious code with the same privilege level as the installer process.
RemediationAI
Users should upgrade to the latest version of OM Workspace (Windows Edition) that addresses this vulnerability by downloading from the official vendor support page at https://support.jp.omsystem.com/en/support/imsg/digicamera/info/omws.html. Until the upgrade can be performed, users should only run the installer from trusted locations with administrator privileges, ensure the installation directory and parent folders are not user-writable by untrusted users, and avoid running installers from network shares, USB drives, or downloads folders where malicious DLLs could be planted. Organizations should consider blocking execution of the vulnerable installer versions through application control policies and educating users about the risks of running installers from untrusted locations. Refer to JVN advisory JVN19505323 at https://jvn.jp/en/jp/JVN19505323/ for additional technical guidance.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today