LINE for Windows loads Msftedit.dll using a relative path but fails to set a secure DLL search path. This oversight lets a malicious DLL placed in the application’s installation folder be loaded before the legitimate system copy, permitting the attacker to execute arbitrary code in the context of the user running LINE. The vulnerability is formally identified as CWE‑427, reflecting a path manipulation weakness that can lead to arbitrary code execution.

The affected vendor is LY Corporation, product LINE for Windows. All releases before version 26.4.0 are vulnerable; upgrading to version 26.4.0 or later removes the weakness.

The CVSS score of 8.4 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not in CISA’s KEV catalog. Attackers must be able to drop a malicious DLL in the LINE installation directory, which typically requires local write permission to that folder. Once the rogue DLL is placed, it will be preloaded, enabling code execution under the current user’s privileges. No public exploit has been disclosed, so the actual utilization risk remains uncertain, but the high severity demands swift remediation.