CVE-2026-6421
Uncontrolled Search Path Vulnerability in MobaXterm msimg32.dll
Publication date: 2026-04-17
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mobatek | mobaxterm_home_edition | to 26.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mobatek MobaXterm Home Edition up to version 26.1 and involves an unknown part of the msimg32.dll library.
The issue is an uncontrolled search path manipulation, which means the software may load malicious files from unintended locations.
An attacker must have local access to exploit this vulnerability, and the attack complexity is high, making exploitation difficult.
The vulnerability has been publicly disclosed, and an exploit may be available.
Upgrading to version 26.2 of MobaXterm Home Edition mitigates this issue.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to a compromise of confidentiality, integrity, and availability of the affected system.
- Confidentiality impact: sensitive information could be exposed.
- Integrity impact: unauthorized modification of data or system state.
- Availability impact: disruption or denial of service to legitimate users.
However, exploitation requires local access and is considered difficult due to high attack complexity.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Mobatek MobaXterm Home Edition to version 26.2 or later.
Since the vulnerability involves an uncontrolled search path in the msimg32.dll library and requires local access with high attack complexity, upgrading the affected component is the recommended mitigation.