CVE-2026-32679

The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, the affected installer may load that DLL and execute its code with the privilege of the user invoking the installer.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN45563482/	Third Party Advisory
https://web.liveon.ne.jp/wp-content/uploads/2026/04/JMSSA2026-001.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:liveon:canonnwcamplugin.exe:1.0.0.0:::::windows::
	cpe:2.3:a:liveon:canonnwcampluginforadmin.exe:1.0.0.0:::::windows::
	cpe:2.3:a:liveon:downloader5installer.exe:1.0.0.0:::::windows::
	cpe:2.3:a:liveon:downloader5installerforadmin.exe:1.0.0.0:::::windows::

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Los instaladores de LiveOn Meet Cliente para Windows (Downloader5Installer.exe y Downloader5InstallerForAdmin.exe) y los instaladores de Canon Network Camera plugin (CanonNWCamPlugin.exe y CanonNWCamPluginForAdmin.exe) cargan de forma insegura Bibliotecas de Enlace Dinámico (DLLs). Si se coloca una DLL maliciosa en el mismo directorio, el instalador afectado puede cargar esa DLL y ejecutar su código con el privilegio del usuario que invoca el instalador.

Information

Published : 2026-04-23 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-32679

Mitre link : CVE-2026-32679

CVE.ORG link : CVE-2026-32679

JSON object : View

Products Affected

liveon

canonnwcampluginforadmin.exe
downloader5installerforadmin.exe
canonnwcamplugin.exe
downloader5installer.exe

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-32679", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32679", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T14:15:21.072117Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "Japan Media Systems Corporation", "product": "Downloader5Installer.exe", "versions": [{"status": "affected", "version": "Ver.1.0.0.0"}]}, {"vendor": "Japan Media Systems Corporation", "product": "Downloader5InstallerForAdmin.exe", "versions": [{"status": "affected", "version": "Ver.1.0.0.0"}]}, {"vendor": "Japan Media Systems Corporation", "product": "CanonNWCamPlugin.exe", "versions": [{"status": "affected", "version": "Ver.1.0.0.0"}]}, {"vendor": "Japan Media Systems Corporation", "product": "CanonNWCamPluginForAdmin.exe", "versions": [{"status": "affected", "version": "Ver.1.0.0.0"}]}]}], "published": "2026-04-23T00:16:45.157", "references": [{"url": "https://jvn.jp/en/jp/JVN45563482/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://web.liveon.ne.jp/wp-content/uploads/2026/04/JMSSA2026-001.pdf", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, the affected installer may load that DLL and execute its code with the privilege of the user invoking the installer."}, {"lang": "es", "value": "Los instaladores de LiveOn Meet Cliente para Windows (Downloader5Installer.exe y Downloader5InstallerForAdmin.exe) y los instaladores de Canon Network Camera plugin (CanonNWCamPlugin.exe y CanonNWCamPluginForAdmin.exe) cargan de forma insegura Bibliotecas de Enlace Din\u00e1mico (DLLs). Si se coloca una DLL maliciosa en el mismo directorio, el instalador afectado puede cargar esa DLL y ejecutar su c\u00f3digo con el privilegio del usuario que invoca el instalador."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liveon:canonnwcamplugin.exe:1.0.0.0:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "3FA8C724-4A73-49CA-AE88-EDFABB7E34D4"}, {"criteria": "cpe:2.3:a:liveon:canonnwcampluginforadmin.exe:1.0.0.0:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "E415E482-79DB-49F5-B6DE-3200E2E80453"}, {"criteria": "cpe:2.3:a:liveon:downloader5installer.exe:1.0.0.0:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "96FEE618-B589-4081-9102-7FC0FAD008BF"}, {"criteria": "cpe:2.3:a:liveon:downloader5installerforadmin.exe:1.0.0.0:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "C2EA05EC-598C-4B21-9350-AAB236D98BE6"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}