HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-41447 — FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that...

·Source: NIST NVD

Updated:

Executive Summary

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege lev

Analysis

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege level when FirmaCheck.exe runs automatically at system startup. CVSS Score: 7.8. Published: 2026-08-03T21:16:38.947.

Indicators of Compromise (1)

CVE (1)
CVE-2026-41447
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

New York Pours $9M Into Water Cyber Defense Amid Attacks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/new-york-pours-9m-into-water-cyber-defense-amid-attacks-image_small-2-a-32403.jpg" align=right hspace=4><b>New York Fast-Tracks Utilities Grants as Hackers Disrupt Water Systems Nationwide</b><br>New York is awarding more than $9 million in cybersecurity grants to water and wastewater systems statewide, fast-tracking the funding a

Bank Info Security
MEDIUMVulnerability

Amgen Tells SEC Hack Exposed Patient Data, Trade Secrets

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/amgen-tells-sec-hack-exposed-patient-data-trade-secrets-image_small-6-a-32401.jpg" align=right hspace=4><b>Drug Maker Says PHI, Research, Confidential Business Data Potentially Stolen</b><br>Pharmaceutical maker Amgen has notified the U.S. Securities and Exchange Commission that cybercriminals have potentially stolen a cache of se

Bank Info Security
MEDIUMVulnerability

Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

Over the weekend, the vendor discovered another vector of authentication bypass CVE-2026-18577 that gives attackers administrator access.

CVE-2026-18577
Dark Reading