Line For Windows
Monthly
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.