Libfido2 EUVD-2026-23135

The vulnerability requires the following specific conditions: (1) Local file system access to a directory in the DLL search path before the legitimate library location, typically the current working directory or a user-writable directory such as %APPDATA%, %TEMP%, or the Python script's directory; (2) The targeted application (libfido2, python-fido2, or yubikey-manager) must be invoked from that directory or have that directory in its module/library search path; (3) The attacker must identify and replicate a DLL that the application loads during execution - this requires knowledge of the application's dependencies and the exact DLL name and function signatures, increasing complexity; (4) The user must execute the vulnerable application from the compromised directory without explicitly setting trusted library paths (e.g., via PYTHONPATH or environment variables that override the default search order). Exploitation is NOT required in default, read-only system configurations or isolated secure enclaves; it is limited to scenarios where users control their own working directory, such as developer workstations, shared lab machines, or CI/CD environments with loose access controls. The AC:H (high attack complexity) designation reflects that an attacker must predict and manufacture a compatible DLL payload, and the timing/context of application invocation must align with the malicious DLL being in the search path.

The CVSS 2.9 score (Low severity) with AV:L/AC:H/PR:N/UI:N/S:U reflects the constrained real-world risk: local access required (AV:L), high attack complexity (AC:H), and integrity impact only (I:L, no confidentiality or availability loss). The high complexity factor suggests the vulnerability requires specific conditions - such as a particular working directory, DLL load sequence, or user interaction context - that limit opportunistic exploitation. EPSS data is not provided, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept code is referenced, indicating this is not actively exploited at scale. Risk is primarily to environments where local attackers can control directory contents within a compromised user's working context or where libfido2/python-fido2 are invoked from untrusted directories. Enterprise deployment of yubikey-manager typically occurs in controlled environments (administrative workstations, secure enclaves) where local DLL injection risk is mitigated by access controls; however, developer workstations using python-fido2 may face elevated risk if developers run untrusted code or clone repositories containing malicious DLLs in their working directory.

An attacker with local file system access (e.g., shared developer workstation, CI/CD runner with loose access controls) places a malicious DLL with the same name as a required system or Yubico library (e.g., 'winscard.dll', 'libusb.dll', or an internal crypto library) in a directory that appears early in the DLL search path - such as the current working directory of a Python script invoking python-fido2, or a directory writable by the user running yubikey-manager. When a developer or administrator runs a yubikey-manager command or a Python script that imports fido2, the application loads the attacker's DLL instead of the legitimate one, executing arbitrary code with the user's privileges (typically local user or administrator on a secure workstation). If the workstation also processes token enrollment or authentication events, the attacker can steal credentials, clone tokens, or maintain persistence.