CVE-2026-9169

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a required dependency is not found locally.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://arenasdk.s3.us-west-2.amazonaws.com/ArenaSDK_ReleaseNotes_v1.0.85.11.txt
https://thinklucid.com/downloads-hub/

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El secuestro del orden de búsqueda de DLL en LUCID Vision Labs Arena SDK 1.0.80.49 en Windows permite a un atacante local ejecutar código arbitrario con los privilegios de la aplicación al colocar una DLL maliciosa en un directorio controlado por el usuario listado en la variable de entorno PATH, que el SDK recorre cuando una dependencia requerida no se encuentra localmente.

Information

Published : 2026-08-07 09:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-9169

Mitre link : CVE-2026-9169

CVE.ORG link : CVE-2026-9169

JSON object : View

Products Affected

No product.

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-9169", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9169", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T15:13:24.877837Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "LUCID Vision Labs", "product": "Arena SDK", "versions": [{"status": "affected", "version": "1.0.80.49", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unknown"}]}], "published": "2026-08-07T09:16:59.430", "references": [{"url": "https://arenasdk.s3.us-west-2.amazonaws.com/ArenaSDK_ReleaseNotes_v1.0.85.11.txt", "source": "vulnerability@ncsc.ch"}, {"url": "https://thinklucid.com/downloads-hub/", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a required dependency is not found locally."}, {"lang": "es", "value": "El secuestro del orden de b\u00fasqueda de DLL en LUCID Vision Labs Arena SDK 1.0.80.49 en Windows permite a un atacante local ejecutar c\u00f3digo arbitrario con los privilegios de la aplicaci\u00f3n al colocar una DLL maliciosa en un directorio controlado por el usuario listado en la variable de entorno PATH, que el SDK recorre cuando una dependencia requerida no se encuentra localmente."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "vulnerability@ncsc.ch"}