CVE-2026-112161: Lack of integrity checks in Mobatek’s MobaXterm
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim’s permissions. Exploitation requires write access to the plugin and does not, in itself, involve privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MobaXterm Personal Edition (Portable)to a version that resolves this vulnerability.Fixed in 26.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of MobaXterm Personal Edition (Portable) 26.4 GA are exposed if an attacker has local write permissions to the CygUtils64.plugin file. The issue is triggered when the user opens a Local Shell session or uses a Cygwin-based function.
What access does an attacker need to exploit it?
The attacker needs local write access to the CygUtils64.plugin file so they can replace the bin/cygwin1.dll library inside it with a malicious library. No privilege escalation is inherent to this issue.
What privileges would malicious code receive?
The malicious library is loaded by MobaXterm and executes with the permissions of the victim who opens the Local Shell session or invokes a Cygwin-based function.