EUVD-2026-49853
GHSA-8gx5-vcv7-jq3w
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (TR-CERT) · only source for this CVE.
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking.
This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.
AnalysisAI
Local privilege escalation in ArkSigner Desktop Client versions 2.2.16.10 through 17062026 allows authenticated attackers to execute arbitrary code via search order hijacking. A low-privileged local user who can place a malicious DLL in a directory that the application searches before the legitimate one, or convince a victim to open a file from such a location, can achieve full system compromise. No public exploit or active exploitation has been reported, but the TR-CERT advisory confirms the vulnerability.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today