CVE-2026-42936

HIGH

SBI Securities Co.,ltd. Hyper Sbi 2 < ver.3.20.0 - Uncontrolled Search Path Element

Title source: rule

Description

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

References (1)

Core 1

Core References

https://jvn.jp/en/jp/JVN59875262/

Scores

CVSS v3 7.8

EPSS 0.0014

EPSS Percentile 4.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-427

Status published

Products (1)

SBI SECURITIES Co.,Ltd./HYPER SBI 2 < ver.3.20.0

Published Jul 15, 2026

Tracked Since Jul 15, 2026