Arbitrary Code Execution in HUION Inspiroy Frego S Windows Driver

Executive Summary

CVE-2026-107091 is a DLL search-path hijacking vulnerability in the HUION Inspiroy Frego S (L310) Windows driver installer version 20.0.1.118. The installer loads VERSION.dll from its own directory instead of a trusted system location, allowing a local attacker to place a crafted DLL in a searched directory and execute arbitrary code when the installer runs.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious DLL files named VERSION.dll in directories where the HUION driver installer (version 20.0.1.118) is run. Monitor for unexpected code execution during installer execution. Use process monitoring tools like Process Monitor to observe DLL loading behavior from non-system directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to information, modification of files or system configurations, disruption of installation processes, and potential privilege escalation if attacker-controlled code executes with elevated privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid running the HUION driver installer from untrusted directories. Ensure the installer and its dependencies are only loaded from secure, system-protected locations. Use secure DLL-loading APIs and restrict DLL search paths to trusted directories. Review and update installer configurations to prevent loading DLLs from attacker-writable locations.

Useful 0 Not Useful 0