Mobatek MobaXterm 26.4 GA bin/cygwin1.dll input validation

Summaryinfo

A vulnerability was found in Mobatek MobaXterm 26.4 GA. It has been rated as problematic. Affected is an unknown function of the file bin/cygwin1.dll. Performing a manipulation results in input validation. This vulnerability is cataloged as CVE-2026-112161. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Mobatek MobaXterm 26.4 GA. This affects an unknown function of the file bin/cygwin1.dll. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.

The advisory is shared at incibe.es. This vulnerability is uniquely identified as CVE-2026-112161 since 10/19/2026. The exploitability is told to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Windowing System Software

Vendor

• Mobatek

Name

• MobaXterm

Version

• 26.4 GA

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion