EUVD-2026-112752
GHSA-wx4r-57mg-fmh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPlant crafted DLL in installer's directory
-
ExploitAdministrator launches Yamaha LAN Monitor installer
-
ExecutionInstaller insecurely loads malicious DLL
-
ImpactArbitrary code execution with admin privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Requires local access to write a specially crafted DLL into the directory from which the Yamaha LAN Monitor for Windows installer is executed, plus an administrator actually launching that installer from the attacker-controlled directory (UI:A). Exploitation is limited by these factors: it is local only (AV:L, not remotely reachable), depends on user interaction by a privileged user, and requires the victim to run the installer co-located with the planted DLL (commonly achieved via a crafted download bundle or a writable shared/Downloads directory). Affects installer versions up to and including Ver.1.9.3. |
| Impact | Signals are moderate and mostly inferred rather than confirmed. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) describes a local, user-interaction-dependent DLL search-order hijack, not a remotely-reachable flaw, so the 8.4 base score is driven by the HIGH triad impact (VC:H/VI:H/VA:H = arbitrary code execution with administrative privileges) rather than by ease of remote reach. No EPSS score, no CISA KEV entry, and no public exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is this_week, consistent with a serious-but-not-emergency, locally-triggered code-execution bug. Net: this is a real, patch-worthy issue for environments running the affected installer, but the AV:L and UI:A requirements make it meaningfully lower real-world risk than a comparable network-reachable RCE; it is not a drop-everything emergency absent exploitation evidence. |
| Exploit ScenarioDerived | An attacker plants a specially crafted DLL (using a name the installer resolves via insecure search order) into a directory such as the user's Downloads folder, then relies on an administrator downloading and launching the Yamaha LAN Monitor installer from that same directory. When the installer runs, it loads the malicious DLL and executes the attacker's code with administrative privileges. No public proof-of-concept is referenced in the available data; exploitation requires local file placement and an administrator running the installer (AV:L, UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 29, 2026
Arbitrary code execution in the Yamaha LAN Monitor for Windows installer versions up to and including Ver.1.9.3 stems from insecure DLL loading (CWE-427). A local attacker who can place a crafted DLL in the directory from which an administrator launches the installer can have that DLL loaded with the installer's administrative privileges, but the attack requires local write access and an administrator actually running the installer from that location. No CISA KEV entry or public exploit code was identified at time of analysis; the issue is local and depends on user interaction.
Earlier versions of this analysis (1)
The Windows installer for Yamaha LAN Monitor resolves DLL dependencies from the directory it is launched from, so a crafted DLL placed alongside the installer can be loaded and executed with the administrative privileges the installer runs under. The weakness is CWE-427 (uncontrolled search path element) with a vendor/NVD CVSS 3.0 base score of 7.8; the assessed vector is local (AV:L) with no privileges required (PR:N) but mandatory user interaction (UI:R), so a victim must launch the installer from a directory the attacker can write to. No public exploit has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
RemediationAI
The supplied sources do not state a fixed version, so consult the Yamaha and JVN advisories at https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN23695234.html and https://jvn.jp/en/jp/JVN23695234/ for the current patched installer release before deployment. Until a fixed installer is confirmed, restrict write access to the directory containing the installer and avoid launching it from Downloads, shared, or other user-writable locations; place the installer in a protected directory and verify its vendor signature or hash before execution. These controls reduce the DLL-planting precondition but do not remove the underlying insecure DLL search behavior, and they depend on administrator discipline and a trusted distribution path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an uncontrolled search path element (CWE-427) in the Windows installer for Yamaha LAN Monitor. Windows DLL search order can cause an installer to resolve a required library from its current working directory or another location writable by the attacker before a trusted system path; because the installer runs with elevated privileges, a malicious DLL placed alongside it can execute arbitrary code in that administrative context. The provided CPE identifies yamaha_corporation:yamaha_lan_monitor_for_windows, and EUVD lists versions from 0 through Ver.1.9.3 as affected; the supplied sources do not describe the precise DLL name or search path involved. The CVSS vector reflects local access, low attack complexity, no privileges, and user interaction, not remote exploitation.
Know when Yamaha Lan Monitor For Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local DLL hijack needing a victim to launch the installer gives AV:L/UI:R/PR:N/AC:L; code runs with admin rights so C:H/I:H/A:H with no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.
Articles & Coverage 1
Executive ViewAI
Yamaha LAN Monitor for Windows (versions up to and including 1.9.3) contains an insecure DLL loading vulnerability that could allow a local attacker to execute arbitrary code with administrative privileges if the installer is run from a directory where the attacker can place files. This means a malicious insider or attacker with local write access to the installation directory could compromise systems during software installation, potentially leading to unauthorized access or data breaches. Leadership should care because this affects the integrity of endpoint administration and requires user interaction, making it a targeted risk for organizations running this software.
No vendor-released patch identified at time of analysis. Limit local write access to directories containing the installer to trusted administrators; enforce application whitelisting to prevent unauthorized DLL loading; require administrators to run installers from secure, write-protected locations; and monitor for anomalous files in installer directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB