What is the CVSS score of CVE-2026-3091?

CVE-2026-3091 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Synology are affected by CVE-2026-3091?

Organizations using Synology Presto Client should be aware of notable risk from CVE-2026-3091, a DLL hijacking vulnerability rated CVSS 6.7.

How to fix or mitigate CVE-2026-3091?

Within 30 days: Identify affected systems running Synology Presto Client and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Synology CVE-2026-3091

MEDIUM

Uncontrolled Search Path Element (CWE-427)

2026-02-24 security@synology.com

Synology Information Disclosure

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 03:16 nvd

MEDIUM 6.7

DescriptionCVE.org

An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files during installation by placing a malicious DLL in advance in the same directory as the installer.

AnalysisAI

Synology Presto Client versions prior to 2.1.3-0672 are vulnerable to DLL hijacking during installation, enabling local attackers with user privileges to read or write arbitrary files by placing malicious libraries in the installer directory. The vulnerability requires user interaction and local access but grants high-impact capabilities including confidentiality and integrity violations. No patch is currently available.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). Affects Presto Client. An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files during installation by placing a malicious DLL in advance in the same directory as the installer.