CVE-2026-26050
DLL Search Path Vulnerability in RICOHジョブログ集計ツール Allows Privilege Escalation
Publication date: 2026-02-20
Last updated on: 2026-02-20
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ricoh | job_log_aggregation_tool | to 1.3.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the installer for the ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to 1.3.7. It is related to insecure Dynamic Link Library (DLL) loading due to improper handling of the DLL search path.
This flaw, classified as an uncontrolled search path element (CWE-427), allows the installer to load DLLs insecurely, which can be exploited to execute arbitrary code with administrative privileges when the installer is run.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can lead to arbitrary code execution with administrative privileges on the affected system.'}, {'type': 'paragraph', 'content': "Because the attacker can execute code with high privileges, it can result in a full compromise of the system's confidentiality, integrity, and availability."}, {'type': 'paragraph', 'content': 'The attack requires local access and user interaction, but once exploited, it can have severe impacts including unauthorized access, data manipulation, and disruption of services.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'The vulnerability is related to insecure DLL loading in the installer for RICOHジョブログ集計ツール versions prior to 1.3.7. Detection involves identifying if the vulnerable installer version is present on the system.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is local and requires user interaction, detection can focus on verifying the installed version of the software and checking for the presence of the installer version prior to 1.3.7.'}, {'type': 'paragraph', 'content': 'You can check the installed version by locating the installation directory, typically at C:\\Program Files\\RICOH\\JobLogCalcTool, and verifying the version of the executable or installer files.'}, {'type': 'paragraph', 'content': 'Suggested commands on a Windows system to detect the installed version include:'}, {'type': 'list_item', 'content': 'Using PowerShell to check the version of the main executable: Get-Item "C:\\Program Files\\RICOH\\JobLogCalcTool\\YourExecutable.exe" | Select-Object VersionInfo'}, {'type': 'list_item', 'content': "Checking installed programs via PowerShell: Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*RICOH Job Log Aggregation Tool*' } | Select-Object Name, Version"}, {'type': 'paragraph', 'content': "Additionally, monitoring for suspicious DLL loading behavior or unexpected DLLs in the installer's directory could help, but specific commands or tools for this are not provided in the available resources."}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the RICOHジョブログ集計ツール installer to version 1.3.7 or later, which addresses the DLL loading vulnerability.
Ensure that the installer is run with administrative privileges and that real-time virus scanning is disabled during installation as per the software’s installation guidelines.
Avoid running the vulnerable installer versions and remove or replace any existing installations with the updated version.
Additionally, maintain good security hygiene by restricting local user permissions to prevent unauthorized execution of installers and monitor for any unusual activity related to DLL loading.