Which versions of LINE for Windows are affected by EUVD-2026-55033?

The LINE for Windows installer (versions prior to 26.4.0) is vulnerable to a file substitution attack that executes malicious code when users run the installer.

How to fix or mitigate EUVD-2026-55033?

Within 24 hours, communicate to all Windows users to avoid running LINE installers from unfamiliar sources and verify their current version is 26.4.0 or later; if LINE is managed within your organization, block distribution of installer versions prior to 26.4.0. Within 7 days, launch a user notification campaign recommending immediate upgrade to LINE version 26.4.0 or later, and establish or update deployment controls (such as installer source whitelisting and signature verification) to prevent installation from untrusted locations. Within 30 days, validate upgrade compliance across the user base, establish monitoring for exploit code emergence, and ensure rapid deployment procedures are in place for any patch released by LINE when it becomes available.

LINE for Windows EUVD-2026-55033

Q: What is the CVSS score of EUVD-2026-55033?

EUVD-2026-55033 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-13133 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-08-10 LY-Corporation

GHSA-w99c-x9xf-3prr

Information Disclosure Microsoft Line For Windows Ly Corporation

8.4

CVSS 4.0 · Vendor: LY-Corporation

Severity by source

Vendor (LY-Corporation) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local file-write staging required (AV:L); no elevated privileges needed to place the DLL in a user-writable directory (PR:N); victim must run the installer (UI:R); no scope change consistent with vendor SC:N assessment.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (LY-Corporation).

CVSS VectorVendor: LY-Corporation

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 07:06 vuln.today

CVE Published

Aug 10, 2026 - 06:00 cve.org

HIGH 8.4

DescriptionCVE.org

A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy.

AnalysisAI

DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.

Technical ContextAI

The root cause is an uncontrolled DLL search path (consistent with CWE-427, Uncontrolled Search Path Element, though no formal CWE is assigned in this record) in LineInst.exe, the installation binary for LINE for Windows by LY Corporation. Windows DLL loading follows a search order that - unless constrained via SetDllDirectory, LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32, or a side-by-side manifest - checks the application's current working directory before the System32 folder. LineInst.exe requests Msftedit.dll (the Microsoft Rich Edit control, a legitimate Windows inbox component) using only its bare filename without a fully-qualified or System32-anchored path. This causes the Windows loader to find and load a same-directory attacker-supplied DLL before discovering the legitimate copy. The affected product is identified by CPE cpe:2.3:a:ly_corporation:line_for_windows:*:*:*:*:*:*:*:* covering all releases prior to 26.4.0.

RemediationAI

Upgrade to LINE for Windows version 26.4.0 or later, which the vendor has confirmed resolves the unsafe DLL search order in LineInst.exe; the advisory is available at https://line.github.io/security-advisory-blog/CVE-2026-13133/. As a compensating control for environments that cannot immediately update, users should download the LINE installer only from the official LY Corporation source and execute it immediately upon download from a directory that is not accessible to other local processes or accounts - running the installer from a newly created, access-controlled temporary folder eliminates the DLL pre-placement window. Enterprise administrators can enforce this via group policy to restrict write access by other processes to common download directories. Note that the risk is strictly installation-phase: systems where LINE is already installed and where the old installer binary has been removed are not exposed.