The vulnerability allows an attacker to execute arbitrary code by exploiting the way MobaXterm Personal Edition Portable (Build 5154, version 26.3) loads the winspool.drv library from the current working directory during startup. By placing a malicious DLL with the same name in that directory, the application unwittingly loads and executes the DLL as the user who launches it. The flaw is a classic example of CWE‑427, where a program loads executables from an untrusted or uncontrolled path. It provides a local attacker the ability to run code with the same privileges as the victim, potentially leading to complete compromise of the local system.

Affected vendors: Mobatek. Product: MobaXterm Personal Edition (Portable). Versions: 26.3 (Build 5154). The vulnerability has been addressed in version 26.4 and later.

The CVSS score of 8.5 classifies this issue as high severity. The EPSS for this CVE is not available and it is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been reported yet. However, the flaw requires local file‑system access to place a malicious DLL in the application directory, making it a local attack vector. Once executed, the attacker gains the same privileges as the user launching the program and can perform any subsequent actions permitted to that user.