CVE-2025-40979

DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\Users<user>\AppData\Local\Temp' directory, which could lead to arbitrary code execution and persistence. This vulnerability is only replicable in versions of Windows 11 and does not affect earlier versions.

CVSS

No CVSS.

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/dll-search-order-hijack-wave-grandstream-networks

Configurations

No configuration.

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de secuestro del orden de búsqueda de DLL en el ejecutable wave.exe para Windows 11, versión 1.27.8. La explotación de esta vulnerabilidad podría permitir a atacantes con acceso local ejecutar código arbitrario mediante la colocación de un archivo arbitrario en el directorio 'C:\Users<user>\AppData\Local\Temp', lo que podría conducir a ejecución de código arbitrario y persistencia. Esta vulnerabilidad solo es replicable en versiones de Windows 11 y no afecta a versiones anteriores.

Information

Published : 2025-09-10 12:15

Updated : 2026-09-30 19:10

NVD link : CVE-2025-40979

Mitre link : CVE-2025-40979

CVE.ORG link : CVE-2025-40979

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-40979", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40979", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-10T20:23:29.435795Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "Grandstream Networks", "product": "Wave", "versions": [{"status": "affected", "version": "0", "lessThan": "1.27.11", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-10T12:15:33.227", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/dll-search-order-hijack-wave-grandstream-networks", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\\Users<user>\\AppData\\Local\\Temp' directory, which could lead to arbitrary code execution and persistence. This vulnerability is only replicable in versions of Windows 11 and does not affect earlier versions."}, {"lang": "es", "value": "Vulnerabilidad de secuestro del orden de b\u00fasqueda de DLL en el ejecutable wave.exe para Windows 11, versi\u00f3n 1.27.8. La explotaci\u00f3n de esta vulnerabilidad podr\u00eda permitir a atacantes con acceso local ejecutar c\u00f3digo arbitrario mediante la colocaci\u00f3n de un archivo arbitrario en el directorio 'C:\\Users<user>\\AppData\\Local\\Temp', lo que podr\u00eda conducir a ejecuci\u00f3n de c\u00f3digo arbitrario y persistencia. Esta vulnerabilidad solo es replicable en versiones de Windows 11 y no afecta a versiones anteriores."}], "lastModified": "2026-09-30T19:10:01.007", "sourceIdentifier": "cve-coordination@incibe.es"}