EUVD-2025-18119Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionGitHub Advisory
ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its own directory before the system path. A local, non-privileged user who can write to the folder containing clip_share.exe can place malicious DLLs there, leading to arbitrary code execution in the context of the server, and, if launched by an Administrator (or another elevated user), it results in a reliable local privilege escalation. This vulnerability is fixed in 3.8.5.
AnalysisAI
DLL hijacking vulnerability in ClipShare Server for Windows (versions prior to 3.8.5) that allows local, non-privileged users to achieve arbitrary code execution and potential privilege escalation by placing malicious DLLs in the application directory. The vulnerability exploits Windows' default DLL search order, where the application directory is searched before system paths, and poses a reliable privilege escalation risk when ClipShare is run by elevated users. This is a local attack requiring write access to the installation directory.
Technical ContextAI
This vulnerability exploits CWE-427 (Uncontrolled Search Path Element), a class of weaknesses where applications load dynamic libraries from untrusted locations without proper validation. ClipShare Server for Windows uses the standard Windows DLL search order, which prioritizes the executable's directory over system directories. The vulnerability specifically involves system libraries like CRYPTBASE.dll and WindowsCodecs.dll, which are legitimately called by the application but loaded insecurely. The affected product is ClipShare (CPE: software/clipshare), specifically the Windows Server component versions before 3.8.5. The root cause is improper DLL search path configuration and lack of explicit full-path DLL loading or manifest-based DLL redirection controls.
RemediationAI
Upgrade to ClipShare version 3.8.5 or later; priority: Critical for systems running ClipShare under elevated privileges; verification: Verify version via Help > About or command line: clip_share.exe --version Access Control Mitigation: Restrict write permissions on the ClipShare installation directory to Administrator users only. Set NTFS ACLs to remove Users/Everyone write access.; command_example: icacls 'C:\Program Files\ClipShare' /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' /grant:r 'Administrators:(OI)(CI)F'; priority: High - immediate workaround while awaiting patch Deployment Hardening: Install ClipShare to a directory with restricted write permissions (not Program Files if possible, or ensure NTFS ACLs are enforced). Avoid installing to user-writable directories.; priority: Medium - preventative measure for new deployments Monitoring: Monitor for unexpected DLL files (CRYPTBASE.dll, WindowsCodecs.dll) appearing in the ClipShare installation directory. Alert on any file modifications in the installation directory.; priority: Medium - detective control
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today