EUVD-2026-45141
GHSA-7vgx-3mff-rjp8
Severity by source
AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Local-only attack requiring high OS privileges to write to DLL search paths and active user interaction to trigger load; full CIA impact from arbitrary code execution within the process.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
3DescriptionCVE.org
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.
AnalysisAI
DLL hijacking in HCL Traveler for Microsoft Outlook (HTMO) permits a local, high-privileged attacker to replace or plant a malicious DLL in a directory searched by the application at load time, enabling arbitrary code execution within the HTMO process context. The CVSS vector (AV:L/AC:L/PR:H/UI:R) confirms the attack is constrained to local access with elevated privileges and requires a user to trigger application load, substantially limiting real-world exploitability despite the full C/I/A:H impact ratings. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
CWE-427 (Uncontrolled Search Path Element) describes the root cause: the application resolves DLL dependencies by searching directories in a predictable order - typically including the application's installation directory, the current working directory, and system paths - without adequately restricting which paths are authoritative. On Windows, this allows an attacker with write access to any directory in the search order to substitute a legitimate DLL with a malicious counterpart. HCL Traveler for Microsoft Outlook is an Outlook add-in integration for HCL Traveler, an enterprise mobile messaging and calendaring synchronization product. The affected product is identified by CPE cpe:2.3:a:hclsoftware:hcl_traveler_for_microsoft_outlook_(htmo):*:*:*:*:*:*:*:*, with the wildcard version indicating no specific release is excluded from the scope. The flaw is tagged as relating to Microsoft and Information Disclosure, consistent with DLL hijacking enabling code execution and data access within a trusted process.
RemediationAI
Consult and apply the fix or mitigations described in HCL Software knowledge base article KB0130919 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130919. No exact patched version number was available in the data at time of analysis - patch availability per vendor advisory is indicated but not independently confirmed with a version string. As interim compensating controls, administrators should restrict write permissions on HTMO's installation directory using Windows ACLs, ensuring only SYSTEM and administrative accounts can modify files in that path; this directly eliminates the attacker's ability to plant a malicious DLL without independently elevating privileges. File integrity monitoring (e.g., via Windows Defender for Endpoint or a third-party FIM tool) should be applied to the HTMO application directory to detect unauthorized DLL replacement. Additionally, review whether the application runs with the least privilege necessary, as reducing the process's runtime privilege level limits the damage from any DLL that is successfully loaded.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today