What is the CVSS score of CVE-2026-32912?

CVE-2026-32912 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L.

Which versions of Windows are affected by CVE-2026-32912?

CVE-2026-32912 presents moderate security risk rated CVSS 5.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32912?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Windows CVE-2026-32912

EUVD-2026-14597 MEDIUM

Untrusted Search Path (CWE-426)

2026-03-23 VulnCheck

GHSA-7j7f-88p8-wh55

Code Injection Microsoft Windows

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.1

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14597

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

CVE Published

Mar 23, 2026 - 21:36 nvd

MEDIUM 5.8

DescriptionCVE.org

OpenClaw versions 2026.2.26 before 2026.3.1 contain a current working directory injection vulnerability in Windows wrapper resolution for .cmd/.bat files that allows shell execution fallback. Attackers can manipulate the current working directory to alter wrapper resolution behavior and achieve command execution integrity loss.

AnalysisAI

OpenClaw versions 2026.2.26 through 2026.3.0 contain a current working directory (CWD) injection vulnerability in the Windows wrapper resolution mechanism for .cmd and .bat files, allowing attackers with local access to manipulate CWD and achieve command execution with integrity compromise. An attacker with local privileges can alter the working directory to inject malicious wrapper scripts that execute instead of legitimate ones, bypassing command execution controls. The vulnerability requires local access and moderate complexity but enables high-integrity impact; no active KEV or widespread exploitation has been reported, but proof-of-concept details are documented in vendor security advisories.

Technical ContextAI

The vulnerability exists in OpenClaw's Windows shell wrapper resolution logic for batch and command files (.cmd/.bat). When OpenClaw resolves wrapper scripts on Windows, it searches the current working directory as part of its path resolution mechanism, consistent with CWE-426 (Untrusted Search Path). By manipulating the CWD before invoking OpenClaw operations, an attacker can place a malicious .cmd or .bat file in a predictable location that OpenClaw will execute instead of the legitimate system wrapper. This is a classic DLL/executable search-path hijacking pattern applied to batch script resolution. The affected product range spans OpenClaw versions before 2026.3.1 (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), with confirmed vulnerability in 2026.2.26 and later versions up to 2026.3.0.

RemediationAI

Upgrade OpenClaw to version 2026.3.1 or later immediately, as the patch directly addresses CWD injection in wrapper resolution. For environments unable to patch immediately, restrict local user execution contexts and enforce strict working directory controls via Windows Group Policy (e.g., disable execution from user-writable directories, enforce AppLocker policies on .cmd/.bat execution, or run OpenClaw under a dedicated service account with minimal directory write permissions). Additionally, audit systems where untrusted local users can manipulate working directories before invoking OpenClaw operations. See vendor advisories at https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j for patch availability and detailed remediation guidance.