CVE-2026-110022: Signed plug-in validation bypass
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs local access to the affected system. No authentication or user interaction is required.
Which systems are exposed?
Systems using the PFI plugin framework are exposed when they deploy and load executable DLLs from signed plugin packages. The issue can lead to full compromise of the affected system.
Why does signature verification not prevent exploitation?
The deployment routine processes archive entries that were not covered by signature verification. An attacker can place an unsigned DLL outside the signed archive prefix so that it overwrites a legitimate signed assembly at the same destination path.
How is attacker code executed after deployment?
The plugin loader loads deployed assemblies through reflection and performs no additional integrity check. Once the unsigned DLL replaces the legitimate assembly, the loader can instantiate attacker-supplied code.