Vulnerability · Published Jan 26, 2026 · Assigned by VulnCheck

CVE-2025-71178Crucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPE

High 7.1

In plain English

A high-severity uncontrolled search path in Crucial Storage Executive from Micron Technology, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer to be loaded instead of the intended system library. A local attacker who can convince a victim to run the installer from a directory containing the attacker-supplied DLL can achieve arbitrary code execution with administrator privileges.

Affected products (as reported)

Vendor	Product	Versions
Micron Technology, Inc.	Crucial Storage Executive	0 – before 11.08.082025.00

Weakness: CWE-427 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://eu.crucial.com/support/storage-executive product, patch
https://www.vulncheck.com/advisories/crucial-storage-executive-installer-dll-preloading-lpe third-party-advisory