CVE-2026-13133 in LINE
Summary
by MITRE • 08/10/2026
A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability resides in the LineInst.exe component of LINE for Windows software before version 26.4.0, representing a classic dynamic link library (dll) hijacking flaw that exploits insecure loading practices. The issue manifests when Msftedit.dll is loaded using a relative path mechanism rather than an absolute path reference, creating an opportunity for privilege escalation through malicious code injection. The vulnerability stems from the application's failure to implement proper DLL search path security measures, specifically the absence of secure search paths as recommended in microsoft security guidelines and aligned with common weakness enumeration cwe-754. When a user installs or runs the vulnerable software, the system searches for Msftedit.dll in a predetermined order that includes the current working directory before checking system directories, allowing an attacker to place a malicious version of the dll in the same directory as LineInst.exe.
The operational impact of this vulnerability extends beyond simple code execution, as it enables attackers to potentially escalate privileges and execute arbitrary commands with elevated permissions. This flaw directly maps to attack techniques described in the attack pattern taxonomy under software supply chain attacks and privilege escalation methods. The malicious dll can perform actions such as keylogging, data exfiltration, or establishing backdoor access points without requiring user interaction beyond the initial installation of the vulnerable software. Attackers can exploit this by placing a crafted dll file in the installer directory where LineInst.exe is located, effectively bypassing normal security controls that would otherwise prevent unauthorized code execution.
Security professionals should implement multiple layers of mitigation to address this vulnerability, beginning with immediate patching to version 26.4.0 or later where the insecure relative path loading has been corrected. System administrators should also deploy application whitelisting policies that restrict execution of unknown binaries in sensitive directories and enforce secure search paths through proper registry configuration. The principle of least privilege should be applied by running LineInst.exe with minimal required permissions, reducing the potential impact of successful exploitation. Additionally, network monitoring solutions should be configured to detect suspicious file creation patterns in installation directories, particularly when malicious dll files are created or modified in locations where legitimate installers reside. Organizations should also conduct regular vulnerability assessments focusing on dynamic link library loading behaviors and ensure that all third-party software components follow secure coding practices that align with industry standards such as those outlined in the defense against sophisticated attacks framework and microsoft secure application lifecycle guidelines.