CVE-2026-41447

Received Received - Intake

FirmaCheck for Windows DLL Hijacking Vulnerability

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege level when FirmaCheck.exe runs automatically at system startup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-41447

Affected Vendors & Products

Vendor	Product	Version / Range
firmacheck	firmacheck	to 1.3.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

FirmaCheck for Windows before 1.3.16 has a dll hijacking vulnerability. Local attackers can exploit this by placing a malicious openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory. When FirmaCheck.exe runs at system startup, it loads this file and executes arbitrary code with startup privileges.

Detection Guidance

Check for the presence of a suspicious openssl.cnf file in C:\Program Files (x86)\Common Files\SSL\ directory. Verify FirmaCheck version is below 1.3.16. Monitor startup processes for FirmaCheck.exe loading unexpected DLLs.

Impact Analysis

This vulnerability allows local attackers to gain high-privilege code execution on your system. If exploited, it could lead to unauthorized access, data theft, malware installation, or system compromise. Since it targets startup processes, it may persist even after reboots.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance penalties, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Update FirmaCheck to version 1.3.16 or later. Remove any untrusted openssl.cnf files from the SSL directory. Restrict write permissions to the Common Files\SSL directory. Scan for malicious DLLs in the path.

Hi! I’m here to help you understand CVE-2026-41447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70