Riskcovery

CVE-2024-11859

DLL Search Order Hijacking in ESET products for Windows

State
Published
Severity
8.4 High
Published
Apr 7, 2025
Updated
Apr 16, 2025
Reserved
Nov 27, 2024

Read the record on cve.org

Description

DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.

Scores

CVSSScoreVectorSource
4.08.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NESET

Weaknesses

  • CWE-427 Uncontrolled Search Path Element

Affected Products

ProductVersions
ESET NOD32 AntivirusESET, spol. s r.o.
  • 18.0.12.0 and earlierAffected
ESET Internet SecurityESET, spol. s r.o.
  • 18.0.12.0 and earlierAffected
ESET Smart Security PremiumESET, spol. s r.o.
  • 18.0.12.0 and earlierAffected
ESET Security UltimateESET, spol. s r.o.
  • 18.0.12.0 and earlierAffected
ESET Endpoint Antivirus for WindowsESET, spol. s r.o.
  • 12.0.2038.0 and earlierAffected
  • 11.1.2053.2 and earlierAffected
ESET Endpoint Security for WindowsESET, spol. s r.o.
  • 12.0.2038.0 and earlierAffected
  • 11.1.2053.2 and earlierAffected
ESET Small Business SecurityESET, spol. s r.o.
  • 18.0.12.0 and earlierAffected
ESET Safe ServerESET, spol. s r.o.
  • 18.0.12.0 and earlierAffected
ESET Server Security for Windows ServerESET, spol. s r.o.
  • 11.1.12005.2 and earlierAffected
ESET Mail Security for Microsoft Exchange ServerESET, spol. s r.o.
  • 11.1.10008.0 and earlierAffected
  • 11.0.10008.0 and earlierAffected
  • 10.1.10014.0 and earlierAffected
ESET Security for Microsoft SharePoint ServerESET, spol. s r.o.
  • 11.1.15001.0 and earlierAffected
  • 11.0.15004.0 and earlierAffected
  • 10.0.15005.1 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.