CVE-2026-25865: Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll ControlRunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Punto Switcherfrom your environment.Uninstall Punto Switcher if it is not required on affected systems to eliminate the vulnerable component.
- Configuration
Modify the application so its call to WinExec supplies a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll (do not rely on the unquoted search path).
Punto Switcher WinExec invocation = use a fully qualified path for RunDll32.exe - Compensating control
Prevent untrusted users from placing executables earlier in the search order by restricting write permissions to directories that are searched for executables (including user-writable locations and system PATH directories), and monitor systems for unexpected executables placed in those locations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25865?
The severity of CVE-2026-25865 is high with a CVSS score of 7.8.
How do I fix CVE-2026-25865?
To fix CVE-2026-25865, ensure that the application paths are fully quoted in the configuration to prevent unquoted search path vulnerabilities.
What software is affected by CVE-2026-25865?
CVE-2026-25865 affects Yandex Punto Switcher version 4.5.0.583 and earlier.
What type of vulnerability is CVE-2026-25865?
CVE-2026-25865 is an unquoted search path vulnerability that allows local attackers to execute arbitrary code.
Can CVE-2026-25865 be exploited remotely?
No, CVE-2026-25865 can only be exploited locally by attackers with access to the system.