Vulnerability · Published Jun 18, 2026 · Assigned by VulnCheck

CVE-2026-25865Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec

High 7.8

In plain English

A high-severity security flaw in Punto Switcher from Yandex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.

Affected products (as reported)

Vendor	Product	Versions
Yandex	Punto Switcher	0 – through 4.5.0.583

Weakness: CWE-428 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://spektion.com/articles/cve-2026-25865-punto-switcher vendor-advisory
https://yandex.ru/soft/punto product
https://www.vulncheck.com/advisories/punto-switcher-unquoted-search-path-via-winexec third-party-advisory