CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Also known as DLL preloading, Binary planting, Insecure library loading.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- adobe acrobat, acrobat 2024, acrobat dc +1 more +3 moreAcrobat Reader | Uncontrolled Search Path Element (CWE-427)7.7 High
- acronis devicelock dlpLocal privilege escalation due to DLL hijacking vulnerability. The following products are...7.3 High
- acronis devicelock dlpLocal privilege escalation due to DLL hijacking vulnerability. The following products are...7.3 High
- acronis devicelock dlpLocal privilege escalation due to EXE hijacking vulnerability. The following products are...7.3 High
- No product listedA DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to...7.8 High
- espressif shared-github-dangerjsEspressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint8.2 High
- mcdope pam usbpam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation6.3 Medium
- synology beedrive, beedrive for desktop +1 moreUncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for...7.8 High
- phoenix contact axc f 1152, axc f 1252, axc f 2000 ea +11 more +13 moreUntrusted Search Path8.7 High
- qtUncontrolled Search Path Element in Qt Network OpenSSL TLS backend allows rogue CA certificate loading1.8 Low
- mullvad vpn, mullvadvpn-app +1 moreMullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer7.3 High
- jarrodwatts claude-hud, claude hud +1 moreClaude HUD 0.0.12 Arbitrary Command Execution via COMSPEC Environment Variable7.3 High
- docker engine, moby docker engine, docker docker/daemon +20 more +22 moreDocker: `PUT /containers/{id}/archive` executes container binary on the host7.2 High
- amd cleanup utility, radeon™ pro vii, radeon™ pro w5000 series graphics products +9 more +11 moreA DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve...7.0 High
- rapid7 metasploit proMetasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading8.5 High
- amd aim-t manageability service, cloud manageability service (acms), manageability api +3 more +5 moreUnsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged...7.0 High
- checkmkPrivilege escalation via mk_mysql agent plugin on Windows5.2 Medium
- bytello share (windows edition) installer executableBytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic...8.4 High
- No product listedUncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3...5.4 Medium
- No product listedUncontrolled search path for some Intel(R) Server Firmware Update Utility Software before version...5.4 Medium
- intel connectivity performance suiteUncontrolled search path for some Intel(R) Connectivity Performance Suite software installers...5.4 Medium
- No product listedRayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control...9.8 Critical
- zte zxcloud iraiDLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview5.7 Medium
- zte zxcloud iraiopenssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview5.5 Medium
- johnson controls ac2000AC2000 Uncontrolled Search Path Element8.4 High
- watchguard agentUncontrolled search path in PluginLauncher allows SYSTEM code execution in WatchGuard Agent8.5 High
- openclawOpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory8.4 High
- openclawOpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files4.1 Medium
- acronis devicelock dlpLocal privilege escalation due to DLL hijacking vulnerability. The following products are...6.7 Medium
- empia technology avacasteMPIA Technology｜AVACAST - DLL Hijacking8.5 High
- openclawOpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables5.4 Medium
- nullsoft scriptable install systemNSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp...7.8 High
- microsoft power appsMicrosoft Power Apps Remote Code Execution Vulnerability8.0 High
- efficientlab, llc controlioDLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation5.1 Medium
- i-pro co., ltd. ip setting softwareIP Setting Software contains an issue with the DLL search path, which may lead to insecurely...7.0 High
- japan media systems corporation canonnwcamplugin.exe, canonnwcampluginforadmin.exe, downloader5installer.exe +1 more +3 moreThe installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and...8.4 High
- firebirdsql firebirdFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution10.0 Critical
- mobatek mobaxterm home editionMobatek MobaXterm Home Edition msimg32.dll uncontrolled search path7.3 High
- eaton intelligent power protector, ipp software +1 moreEaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable...7.8 High
- adobe photoshop installerPhotoshop Installer | CWE-427: Uncontrolled Search Path Element8.6 High
- lenovo software fixDuring an internal security assessment, a potential vulnerability was discovered in Lenovo...7.0 High
- lenovo service bridgeA potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain...5.4 Medium
- omron social solutions co., ltd. powerattendant standard editionVulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application7.8 High
- keepassxcKeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.3 High
- nomachineNoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.8 High
- japan computer emergency response team coordination center (jpcert/cc) emocheckEmocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the...8.4 High
- No product listedA Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5...8.8 High
- ufrisk memprocfsMemProcFS < 5.17 DLL/Shared Library Hijacking8.5 High
- openclawOpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy5.8 Medium
- acronis true imageLocal privilege escalation due to DLL hijacking vulnerability. The following products are...6.7 Medium
- Show moreLoading…