CVE-2026-11967: Arbitrary code execution in MobaXterm Personal Edition (Portable)
MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directory as the portable executable. Because the application automatically loads the winspool.drv library from that location during startup, an attacker with local access can place a specially crafted DLL alongside the executable to be executed when the victim launches the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MobaXterm Personal Edition (Portable)to a version that resolves this vulnerability.Fixed in 26.4 - Compensating control
Prevent untrusted users from writing files into the directory containing the MobaXterm Portable executable (for example, set file-system permissions to restrict write access or avoid running the portable executable from world-writable/untrusted locations) to mitigate DLL planting until the application is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11967?
The severity of CVE-2026-11967 is high, with a CVSS score of 8.5.
How do I fix CVE-2026-11967?
To fix CVE-2026-11967, upgrade to MobaXterm Personal Edition (Portable) version 26.4 or later.
What type of vulnerability is CVE-2026-11967?
CVE-2026-11967 is an arbitrary code execution vulnerability.
What versions are affected by CVE-2026-11967?
CVE-2026-11967 affects MobaXterm Personal Edition (Portable) version 26.3 (Build 5154).
How does CVE-2026-11967 exploit work?
CVE-2026-11967 exploits the vulnerability by loading a malicious DLL located in the same directory as the portable executable during application startup.