What is the CVSS score of CVE-2026-36574?

CVE-2026-36574 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of CactusViewer are affected by CVE-2026-36574?

Wassimulator CactusViewer v2.3.0 for Windows contains a local privilege escalation vulnerability that could enable arbitrary code execution if exploited.

How to fix or mitigate CVE-2026-36574?

Within 24 hours: Identify if CactusViewer v2.3.0 is deployed in your environment and on how many systems. Within 7 days: For deployed instances, implement file permission controls on DLL directories, restrict application execution to non-administrator accounts, and evaluate operational mitigations such as air-gapping or disabling the tool if not business-critical. Within 30 days: Monitor the vendor repository for a patched version (v2.3.1 or later) and plan upgrade timelines; if no patch becomes available, transition to alternative image viewers.

CactusViewer CVE-2026-36574

EUVD-2026-34098 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-06-03 mitre

GHSA-8vxw-prwx-j95w

RCE N A

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 21:30 vuln.today

CVSS changed

Jun 08, 2026 - 19:22 NVD

7.8 (HIGH)

CVE Published

Jun 03, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.

AnalysisAI

Local privilege escalation and arbitrary code execution in Wassimulator CactusViewer v2.3.0 (Windows) occurs through DLL hijacking, where the application loads a malicious DLL from a writable directory instead of the legitimate library. Exploitation requires user interaction to launch the application after an attacker plants the crafted DLL, and no public exploit identified at time of analysis. EPSS rates exploitation probability at just 0.02% (5th percentile), reflecting the niche user base of this open-source image viewer.

Technical ContextAI

CactusViewer is an open-source image viewer distributed as a standalone Windows executable (CactusViewer.exe) via GitHub releases. The root cause maps to CWE-427 (Uncontrolled Search Path Element), a class of bug where Windows applications resolve DLL dependencies using the default search order - which includes the application's working directory and other writable paths - without specifying fully qualified paths or using SetDefaultDllDirectories/SafeDllSearchMode hardening. An attacker who can place a malicious DLL with the expected name in a directory earlier in the search order than the legitimate one causes the loader to map and execute attacker-controlled code in the process. The referenced issue (#65) on the project's GitHub appears to be the disclosure thread for this flaw.

RemediationAI

No vendor-released patch identified at time of analysis - the linked GitHub issue (https://github.com/Wassimulator/CactusViewer/issues/65) appears to be the open disclosure thread and no fixed release is referenced in the available data. As compensating controls, organizations should remove CactusViewer v2.3.0 from endpoints if it is not business-critical, since this is a hobbyist viewer with limited operational value. If retention is required, run the application only from a directory where standard users lack write permissions (e.g., Program Files rather than Downloads or a user-writable folder), which prevents low-privilege attackers from planting a hijack DLL alongside the binary. Application-control policies (Windows Defender Application Control, AppLocker) can block unsigned DLL loads from user-writable paths, though this may break applications that legitimately load DLLs that way. Monitor the upstream repository for a fixed release before redeploying.