Microsoft EUVD-2026-18420

The vulnerability stems from CWE-427 (Uncontrolled Search Path Element), a classic DLL hijacking flaw where the application searches for dynamically loaded libraries in directories where an attacker can place malicious DLL files before the legitimate system directories are checked. Acronis True Image, a Windows-based backup and system imaging utility, fails to implement secure DLL loading practices such as hardcoded absolute paths or DLL pinning. The attack requires local file system access and exploitation is contingent on a user interaction trigger-the application must execute code that attempts to load the hijacked DLL. This is a local-attack-vector vulnerability (AV:L) with high complexity (AC:H) reflecting the need for specific conditions and user action (UI:R) to succeed.