CVE-2021-26807

Published: Apr 30, 2021Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentially run code locally through unsigned DLL loading.

Affected (1)

Products: Gog: Galaxy

Gog

1 product

Galaxy

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gog Galaxy	Version 2.0.28.9

Related CWEs

CWE-426

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (4)

https://illuminati.services/2021/04/29/cve-2021-26807-gog-galaxy-v2-0-35-dll-load-order-hijacking/

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.gog.com

Source: cve@mitre.org

Vendor Advisory

https://illuminati.services/2021/04/29/cve-2021-26807-gog-galaxy-v2-0-35-dll-load-order-hijacking/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.gog.com

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.