HIGH

CVE-2026-41447

2026-08-03 CVSS v3.1

CVSS

7.8

Description

FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege level when FirmaCheck.exe runs automatically at system startup.

Weakness (CWE)

CWE-426

EPSS Score

0.11%

Probability of exploitation in next 30 days

1.7th percentile

References

https://www.vulncheck.com/advisories/firmacheck-dll-hijacking-via-unvalidated-openssl-configuration-path https://www.zucchetti.it/it/cms/soluzioni/gestione-documentale/firme-e-marche/software-gestione-firme-digitali-firmacheck/software-gratuito-gestione-firme-e-documenti-descrizione.html

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE