CVE-2025-71178

Crucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPE

State: Published
Severity: 7.1 High
Published: Jan 26, 2026
Updated: May 14, 2026
Reserved: Jan 22, 2026

Description

Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer to be loaded instead of the intended system library. A local attacker who can convince a victim to run the installer from a directory containing the attacker-supplied DLL can achieve arbitrary code execution with administrator privileges.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
Crucial Storage ExecutiveMicron Technology, Inc.	before 11.08.082025.00Affected

References

https://eu.crucial.com/support/storage-executiveproductpatch
https://www.vulncheck.com/advisories/crucial-storage-executive-installer-dll-preloading-lpethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.