What is the CVSS score of EUVD-2026-51142?

EUVD-2026-51142 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM Aspera Desktop are affected by EUVD-2026-51142?

IBM Aspera Desktop App versions 1.0.5-1.0.19 contain a local code execution vulnerability (CVE-2026-11980, CVSS 7.3) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-51142?

Within 24 hours, identify all systems running IBM Aspera Desktop App versions 1.0.5-1.0.19 using asset discovery or endpoint management tools. Within 7 days, deploy the vendor patch to all affected systems, prioritizing multi-user and shared systems. Within 30 days, verify patch coverage across the organization and document any systems where the application has been disabled as an alternative control.

IBM Aspera Desktop EUVD-2026-51142

| CVE-2026-11980 HIGH

Use of Inherently Dangerous Function (CWE-242)

2026-07-30 ibm

GHSA-7595-v3wg-24r5

RCE IBM Aspera Desktop App

7.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Local DLL hijack needing an existing foothold to write a searched path (AV:L, PR:L) and the victim to launch the app (UI:R); code runs as the user with full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:27 vuln.today

CVE Published

Jul 30, 2026 - 14:16 nvd

HIGH 7.3

DescriptionCVE.org

IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

AnalysisAI

Arbitrary code execution in the IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) arises from insecure DLL loading at application start-up, allowing a local low-privileged attacker who can place a malicious DLL in a path the app searches to run code in the context of the launching user. IBM (the reporter and vendor) has published a fix, and there is no public exploit identified at time of analysis. Impact is high to confidentiality, integrity, and availability, but exploitation is gated by local access and the user launching the application.

Technical ContextAI

The affected component is IBM Aspera Desktop App, IBM's client for the Aspera FASP high-speed file-transfer platform, running on Windows (DLL loading is a Windows library-resolution behavior). The flaw is a classic DLL search-order / insecure library-loading weakness: at start-up the application resolves and loads one or more DLLs by name without fully qualifying the trusted path, so a same-named DLL placed earlier in the search order (e.g. the application directory or a writable directory in PATH) is loaded and its DllMain/exported code executes with the privileges of the process. The CVE is mapped to CWE-242 (Use of Inherently Dangerous Function); functionally this manifests as the well-known untrusted-search-path / DLL-hijacking pattern (CWE-427/CWE-426 family), where the dangerous behavior is loading a module by an unqualified name.

RemediationAI

Upgrade the IBM Aspera Desktop App to the fixed release published in IBM's advisory (Patch available per vendor advisory; the exact fixed version is not stated in the provided data - confirm at https://www.ibm.com/support/pages/node/7280939 before deploying). Until patched, reduce DLL-hijacking exposure by ensuring the application's install directory and any directories on the system/user PATH are not writable by low-privileged users, removing writable or attacker-controlled entries from PATH, and installing the app to a protected location (e.g. Program Files) so non-admin users cannot drop DLLs alongside the executable; these controls have minimal functional side effects. Additionally, restrict who can log in locally to hosts running the app and monitor for unexpected DLLs appearing in the application directory. Avoid launching the app from network shares or user-writable working directories, as this widens the search-order attack surface.