eMPIA AVACAST up to 5.10.10.43 DLL uncontrolled search path

Summaryinfo

A vulnerability identified as problematic has been detected in eMPIA AVACAST up to 5.10.10.43. The impacted element is an unknown function of the component DLL Handler. Performing a manipulation results in uncontrolled search path. This vulnerability is cataloged as CVE-2026-7279. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in eMPIA AVACAST up to 5.10.10.43. This affects some unknown functionality of the component DLL Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directory, resulting in arbitrary code execution with system privileges when the system loads the DLL.

The advisory is shared at twcert.org.tw. This vulnerability is uniquely identified as CVE-2026-7279 since 04/28/2026. The exploitability is told to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/28/2026). MITRE ATT&CK project uses the attack technique T1574 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• eMPIA

Name

• AVACAST

Version

• 5.10.10.0
• 5.10.10.1
• 5.10.10.2
• 5.10.10.3
• 5.10.10.4
• 5.10.10.5
• 5.10.10.6
• 5.10.10.7
• 5.10.10.8
• 5.10.10.9
• 5.10.10.10
• 5.10.10.11
• 5.10.10.12
• 5.10.10.13
• 5.10.10.14
• 5.10.10.15
• 5.10.10.16
• 5.10.10.17
• 5.10.10.18
• 5.10.10.19
• 5.10.10.20
• 5.10.10.21
• 5.10.10.22
• 5.10.10.23
• 5.10.10.24
• 5.10.10.25
• 5.10.10.26
• 5.10.10.27
• 5.10.10.28
• 5.10.10.29
• 5.10.10.30
• 5.10.10.31
• 5.10.10.32
• 5.10.10.33
• 5.10.10.34
• 5.10.10.35
• 5.10.10.36
• 5.10.10.37
• 5.10.10.38
• 5.10.10.39
• 5.10.10.40
• 5.10.10.41
• 5.10.10.42
• 5.10.10.43

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion