Monthly
Arbitrary code execution in the Yamaha LAN Monitor for Windows installer versions up to and including Ver.1.9.3 stems from insecure DLL loading (CWE-427). A local attacker who can place a crafted DLL in the directory from which an administrator launches the installer can have that DLL loaded with the installer's administrative privileges, but the attack requires local write access and an administrator actually running the installer from that location. No CISA KEV entry or public exploit code was identified at time of analysis; the issue is local and depends on user interaction.
Local arbitrary code execution in Adobe Creative Cloud Desktop Application versions up to and including 6.10.0.252.41 is enabled by an uncontrolled search path element (CWE-427). A low-privileged attacker can exploit the application's component-loading behavior, but the victim must open a malicious file, and the resulting code runs only in the current user's context. The flaw is rated CVSS 7.3, no public exploit has been identified at time of analysis, and Adobe has published advisory APSB26-135.
Privilege escalation and possible arbitrary code execution in HP One Agent on certain HP PC products stem from an uncontrolled search path element (CWE-427), which lets a file planted in a location the agent searches be loaded in place of a legitimate component. The flaw is local, not remote: an attacker must already hold a low-privileged account on an HP PC where HP One Agent is installed, after which no user interaction is required and confidentiality, integrity and availability impacts are all rated high (CVSS 4.0 base 8.5; vendor-assessed CVSS 3.1 7.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label places it in this week's remediation queue rather than an emergency; HP has published advisory HPSBHF04150 covering software updates.
Uncontrolled search path handling in Luxion KeyShot's BIP file parser enables code execution in the context of the KeyShot process when a victim opens a crafted BIP file or visits a malicious page that delivers one. The flaw is CWE-427: KeyShot can load a library from an unsecured, attacker-influenced location, but exploitation is gated by mandatory user interaction (UI:R), uses a local vector (AV:L), and requires the attacker to place a malicious library where KeyShot searches; CVSS 3.1 base score is 7.8 with PR:N, so no prior authentication is required. No public exploit was identified at time of analysis and there is no CISA KEV confirmation.
ASUS Armoury Crate on Windows loads at least one dynamic-link library by name without a fully qualified path, so a local attacker who can write to a directory that precedes the legitimate library in the Windows DLL search order can plant a malicious DLL and have it loaded by a high-privilege Armoury Crate component, yielding arbitrary code execution at SYSTEM integrity. The flaw (CWE-427) is local-only: the attacker must already hold low-privileged code execution on the host (CVSS:4.0 AV:L/PR:L, independently assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.5 CVSS 4.0 base) and must be able to write to the hijackable path; the payload then runs when the privileged process or service next starts, with no victim interaction required. Only machines with Armoury Crate installed are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a credible but not emergency-tier hardening/patching priority for gaming laptops, desktops and ROG/TUF motherboard owners.
An uncontrolled search path element in Dell Application Store (CWE-427) lets a local, low-privileged user plant a malicious library or executable in a location the installer or updater searches, so the higher-privileged Application Store process loads attacker code and yields elevation of privilege plus arbitrary code execution. All builds prior to 26.05.0.7 are affected; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), meaning the attacker must already hold a local account or code-execution primitive on the host, no victim interaction is required, and impact is confined to that machine. There is no remote attack surface here - it is a post-compromise or insider escalation step rather than an entry vector - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
Arbitrary code execution in Adobe Dimension (all versions from 0 through 4.1.8 inclusive) is possible because the application loads libraries/DLLs from an uncontrolled search path, allowing a local attacker to plant a malicious file that Dimension resolves and loads. Exploitation yields code execution in the context of the current user and requires the victim to launch the application (UI:R) after a local attacker with user-level write access has staged the malicious element in an attacker-influenceable directory; the scope-changed CVSS vector (AV:L/PR:N/UI:R/S:C) means no prior privileges are needed but local access and user interaction are. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Adobe PSIRT published advisory apsb26-171 for tracking.
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.
Arbitrary code execution in the Yamaha LAN Monitor for Windows installer versions up to and including Ver.1.9.3 stems from insecure DLL loading (CWE-427). A local attacker who can place a crafted DLL in the directory from which an administrator launches the installer can have that DLL loaded with the installer's administrative privileges, but the attack requires local write access and an administrator actually running the installer from that location. No CISA KEV entry or public exploit code was identified at time of analysis; the issue is local and depends on user interaction.
Local arbitrary code execution in Adobe Creative Cloud Desktop Application versions up to and including 6.10.0.252.41 is enabled by an uncontrolled search path element (CWE-427). A low-privileged attacker can exploit the application's component-loading behavior, but the victim must open a malicious file, and the resulting code runs only in the current user's context. The flaw is rated CVSS 7.3, no public exploit has been identified at time of analysis, and Adobe has published advisory APSB26-135.
Privilege escalation and possible arbitrary code execution in HP One Agent on certain HP PC products stem from an uncontrolled search path element (CWE-427), which lets a file planted in a location the agent searches be loaded in place of a legitimate component. The flaw is local, not remote: an attacker must already hold a low-privileged account on an HP PC where HP One Agent is installed, after which no user interaction is required and confidentiality, integrity and availability impacts are all rated high (CVSS 4.0 base 8.5; vendor-assessed CVSS 3.1 7.8). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority label places it in this week's remediation queue rather than an emergency; HP has published advisory HPSBHF04150 covering software updates.
Uncontrolled search path handling in Luxion KeyShot's BIP file parser enables code execution in the context of the KeyShot process when a victim opens a crafted BIP file or visits a malicious page that delivers one. The flaw is CWE-427: KeyShot can load a library from an unsecured, attacker-influenced location, but exploitation is gated by mandatory user interaction (UI:R), uses a local vector (AV:L), and requires the attacker to place a malicious library where KeyShot searches; CVSS 3.1 base score is 7.8 with PR:N, so no prior authentication is required. No public exploit was identified at time of analysis and there is no CISA KEV confirmation.
ASUS Armoury Crate on Windows loads at least one dynamic-link library by name without a fully qualified path, so a local attacker who can write to a directory that precedes the legitimate library in the Windows DLL search order can plant a malicious DLL and have it loaded by a high-privilege Armoury Crate component, yielding arbitrary code execution at SYSTEM integrity. The flaw (CWE-427) is local-only: the attacker must already hold low-privileged code execution on the host (CVSS:4.0 AV:L/PR:L, independently assessed as CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.5 CVSS 4.0 base) and must be able to write to the hijackable path; the payload then runs when the privileged process or service next starts, with no victim interaction required. Only machines with Armoury Crate installed are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a credible but not emergency-tier hardening/patching priority for gaming laptops, desktops and ROG/TUF motherboard owners.
An uncontrolled search path element in Dell Application Store (CWE-427) lets a local, low-privileged user plant a malicious library or executable in a location the installer or updater searches, so the higher-privileged Application Store process loads attacker code and yields elevation of privilege plus arbitrary code execution. All builds prior to 26.05.0.7 are affected; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), meaning the attacker must already hold a local account or code-execution primitive on the host, no victim interaction is required, and impact is confined to that machine. There is no remote attack surface here - it is a post-compromise or insider escalation step rather than an entry vector - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Siemens Software Center (all versions) loads dynamic-link libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to stage a crafted DLL where the application will load it and achieve arbitrary code execution in the application's context, with full confidentiality, integrity, and availability impact on the affected host. The vendor scores this CWE-427 DLL-hijacking issue CVSS 4.0 8.4 (AV:L/AC:L/AT:N/PR:H/UI:N), and our independent assessment agrees on the local vector, no user interaction, unchanged scope, and high C/I/A impact. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV; exploitation is constrained to a local, already highly privileged actor able to write to a directory on the loader's search path.
Arbitrary code execution in Adobe Dimension (all versions from 0 through 4.1.8 inclusive) is possible because the application loads libraries/DLLs from an uncontrolled search path, allowing a local attacker to plant a malicious file that Dimension resolves and loads. Exploitation yields code execution in the context of the current user and requires the victim to launch the application (UI:R) after a local attacker with user-level write access has staged the malicious element in an attacker-influenceable directory; the scope-changed CVSS vector (AV:L/PR:N/UI:R/S:C) means no prior privileges are needed but local access and user interaction are. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Adobe PSIRT published advisory apsb26-171 for tracking.
Local privilege escalation in the Windows AI component shipped with Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2025 allows an attacker who already holds a low-privileged local account to gain SYSTEM-level code execution by planting a malicious DLL in a directory the component searches ahead of a trusted location (DLL search-order hijacking). Microsoft rates it CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and our independent assessment concurs: exploitation needs a pre-existing authenticated local foothold plus the ability to write to the searched path, with no user interaction and low complexity, so purely remote or unauthenticated attackers cannot trigger it directly. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as 'none' and automatable as 'no', though technical impact is assessed as total once the prerequisite local access is obtained; the vendor has released a patch, and hosts without the Windows AI feature or where untrusted users cannot obtain local accounts face materially lower exposure. This is a credible but not emergency-level priority.
ImageMagick on Windows (versions through 7.1.2-33 and the legacy 6.x line through 6.9.13-58) can be induced to execute an attacker-supplied gswin64c.exe when it converts a PDF, PostScript, or EPS file while Ghostscript is left unregistered. The flaw is an uncontrolled search path (CWE-427) in NTGhostscriptEXE(): instead of resolving the Ghostscript binary through the registry, ImageMagick falls back to launching 'gswin64c.exe' by bare filename, so a malicious binary dropped in ImageMagick's current working directory is executed with ImageMagick's privileges. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and exploitation is conditional: it requires a Windows host with unregistered Ghostscript, attacker write access to the working directory, and a victim-triggered conversion - making this a genuine but situational, non-urgent issue rather than a mass-exploitation priority.