CVE-2026-6421: Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path
A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mobatek MobaXterm Home Edition (msimg32.dll uncontrolled search path)to a version that resolves this vulnerability.Fixed in 26.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6421?
The severity of CVE-2026-6421 is considered moderate due to the potential for local exploitation of the uncontrolled search path.
How do I fix CVE-2026-6421?
To fix CVE-2026-6421, ensure that you update the Mobatek MobaXterm Home Edition to version 26.2 or later.
What type of vulnerability is CVE-2026-6421?
CVE-2026-6421 is classified as an uncontrolled search path vulnerability affecting the msimg32.dll library.
Who is affected by CVE-2026-6421?
Users of Mobatek MobaXterm Home Edition versions up to 26.1 are affected by CVE-2026-6421.
Can CVE-2026-6421 be exploited remotely?
CVE-2026-6421 requires local access for exploitation, meaning it cannot be triggered remotely.