CVE-2026-6421
Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path
- State
- Published
- Severity
- 7.3 High
- Published
- Apr 17, 2026
- Updated
- Apr 17, 2026
- Reserved
- Apr 16, 2026
Description
A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.3 High | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | VulDB |
| 3.0 | 7.0 High | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.0 Medium | AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
MobaXterm Home EditionMobatek |
|
References
- VDB-358020 | Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search pathvdb-entry
- VDB-358020 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #778851 | Mobatek MobaXterm 26.1.0.5456 Uncontrolled Search Path -- DLL hijacking with msimg32.dllthird-party-advisory
- https://drive.google.com/file/d/17bbNDzfoD3NNPlUMkSYs8bVzVbbwddnU/viewexploit
- https://mobaxterm.mobatek.net/download-home-edition.htmlrelated
- https://download.mobatek.net/2622026032581854/MobaXterm_Installer_v26.2.zippatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.