Log in Start free

Vulnerability · Published Apr 17, 2026 · Assigned by VulDB

CVE-2026-6421Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path

High 7.0

In plain English

A high-severity uncontrolled search path in MobaXterm Home Edition from Mobatek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 95.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected products (as reported)

VendorProductVersions
Mobatek MobaXterm Home Edition 26.026.1

Weakness: CWE-427, CWE-426 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References