CVE-2025-26861CWE-427

CVE-2025-26861

High · published October 15, 2025

CVSS v3.0
7.8
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

⚡ An uncontrolled search path vulnerability could let attackers execute arbitrary code just by placing a crafted DLL next to your RemoteCall Remote Support Program! 🚨 Think of it like a delivery person leaving a package in the wrong mailbox — if someone can slip in the wrong item, they could have access to your entire home! This could allow an attacker to run malicious code on your system, potentially leading to data theft, system crashes, or even full control over your environment. It's like handing someone the keys to your entire operation! We definitely don’t want that kind of uninvited guest.

Put simply

Think of it like a delivery person leaving a package in the wrong mailbox — if someone can slip in the wrong item, they could have access to your entire home! Versions prior to 5.3.0 of the RemoteCall Remote Support Program are vulnerable to an arbitrary code execution flaw due to an uncontrolled search path element, allowing a crafted DLL to be executed unintentionally by the program.

What to do

This could allow an attacker to run malicious code on your system, potentially leading to data theft, system crashes, or even full control over your environment. It's like handing someone the keys to your entire operation! We definitely don’t want that kind of uninvited guest. Upgrade to RemoteCall version 5.3.0 or later immediately to close this vulnerability. Additionally, consider implementing strict controls on the DLLs that your application can access and monitor for suspicious files in relevant directories. You’ve got this! With a quick update and a few precautions, you’ll have your system locked down tighter than a safe! 🛡️

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.5th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-10-15T10:15Z
References (2)
EPSS history
Timeline
  • 15 OCT 06:07Z
    RemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 contain an uncontrolled search path element vulnerability
    cvelistv5