ANSSI DFIR-ORC up to 10.2.7/10.2.x DLL uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in ANSSI DFIR-ORC up to 10.2.7/10.2.x. This impacts an unknown function of the component DLL Handler. This manipulation causes uncontrolled search path. This vulnerability is registered as CVE-2026-11958. The attack needs to be launched locally. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in ANSSI DFIR-ORC up to 10.2.7/10.2.x. Affected by this vulnerability is an unknown functionality of the component DLL Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. The CWE definition for the vulnerability is CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and executed from that location with administrative privileges, the malicious library can be loaded automatically, allowing the attacker to gain administrator privileges on the affected machine.

The weakness was published by Rémi Delabrosse and Nicolas Rodrigues. The advisory is shared at incibe.es. This vulnerability is known as CVE-2026-11958 since 06/11/2026. The exploitation appears to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading to version 10.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37877). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ANSSI

Name

• DFIR-ORC

Version

• 10.0
• 10.1
• 10.2
• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4
• 10.2.5
• 10.2.6
• 10.2.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion