CVE-2026-9169

{
  "id": "CVE-2026-9169",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T09:16:59.430",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a required dependency is not found locally."
    },
    {
      "lang": "es",
      "value": "El secuestro del orden de búsqueda de DLL en LUCID Vision Labs Arena SDK 1.0.80.49 en Windows permite a un atacante local ejecutar código arbitrario con los privilegios de la aplicación al colocar una DLL maliciosa en un directorio controlado por el usuario listado en la variable de entorno PATH, que el SDK recorre cuando una dependencia requerida no se encuentra localmente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "LUCID Vision Labs",
          "product": "Arena SDK",
          "defaultStatus": "unknown",
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "1.0.80.49",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T15:13:24.877837Z",
          "id": "CVE-2026-9169",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://arenasdk.s3.us-west-2.amazonaws.com/ArenaSDK_ReleaseNotes_v1.0.85.11.txt",
      "source": "[email protected]"
    },
    {
      "url": "https://thinklucid.com/downloads-hub/",
      "source": "[email protected]"
    }
  ]
}