CVE-2021-26807

Katalog CVE

CVSS 7.8 · High EPSS 0,48%

Kerentanan Untrusted Search Path pada gog galaxy. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentially run code locally through unsigned DLL loading.

Rincian

Terbit di NVD

30 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.gog.com advisory vendor
• https://illuminati.services/2021/04/29/cve-2021-26807-gog-galaxy-v2-0-35-dll-load-order-hijacking/ exploit · advisory pihak ketiga