CVE-2024-11859: DLL Search Order Hijacking Vulnerability

CVE-2024-11859 Overview

CVE-2024-11859 is a DLL Search Order Hijacking vulnerability affecting ESET security products for Windows. An attacker with administrator privileges can place a malicious dynamic-link library in a location searched by an ESET process. The vulnerable process then loads the attacker-controlled DLL and executes its code within the trusted product context. The flaw is tracked under CWE-427: Uncontrolled Search Path Element. ESET has published a security advisory confirming the issue is fixed in updated product versions.

Critical Impact
A local attacker with administrator rights can execute arbitrary code within an ESET product process, enabling defense evasion, persistence, and code execution under a trusted security binary.

Affected Products

ESET products for Windows (see vendor advisory for exact affected builds)
Windows endpoints running vulnerable ESET installations
Enterprise environments deploying ESET agents managed via ESET Protect

Discovery Timeline

2025-04-07 - CVE-2024-11859 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11859

Vulnerability Analysis

The vulnerability arises from how ESET product components resolve dependent DLLs at load time. When a Windows process calls LoadLibrary without specifying a fully qualified path, the loader walks a defined search order that includes the application directory and other locations. An attacker who can write a file into one of those directories can supply a rogue DLL with the same name as a legitimate dependency.

Once loaded, the malicious library executes inside a process signed and trusted as part of the security suite. This grants the attacker code execution in a context that endpoint controls and administrators typically trust. The issue is local in nature and requires prior administrator access on the target host.

Root Cause

The root cause is uncontrolled search path element handling during library resolution [CWE-427]. The affected binaries do not enforce a safe, absolute load path or restrict loading to signed system libraries. Windows therefore resolves the dependency using the standard search order, which an attacker with write access to a searched directory can influence.

Attack Vector

Exploitation is local. The attacker must already hold administrator privileges on the endpoint. They plant a crafted DLL in a directory that Windows searches before the intended library location, then trigger the vulnerable ESET process to load it. The rogue DLL runs when the process resolves its imports or calls LoadLibrary, giving the attacker code execution within the ESET process. This technique aligns with MITRE ATT&CK T1574.001: DLL Search Order Hijacking.

See the ESET Security Advisory on DLL Hijacking for technical details and affected versions.

Detection Methods for CVE-2024-11859

Indicators of Compromise

Unexpected DLL files present in ESET installation directories or adjacent paths that Windows searches during library resolution.
ESET product processes loading modules from non-standard locations or modules that are unsigned or signed by an unexpected publisher.
Recent administrator-level file writes to directories associated with ESET binaries preceding process restarts.

Detection Strategies

Hunt for image loads by ESET processes where the loaded module path does not match the vendor's canonical installation directory.
Alert on new or modified DLLs in security product directories using file integrity monitoring.
Correlate administrator logons with subsequent DLL writes and ESET service restarts to surface staging behavior.

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image Loaded) and forward events to a SIEM for baseline analysis of ESET module loads.
Track Microsoft-Windows-CodeIntegrity events for unsigned or untrusted image load attempts by security products.
Review PowerShell and command-line telemetry for administrator activity that writes DLLs into program directories.

How to Mitigate CVE-2024-11859

Immediate Actions Required

Update all ESET products for Windows to the fixed versions listed in the vendor advisory.
Audit endpoints for unauthorized DLLs in ESET installation directories and remove any unexpected files.
Restrict local administrator access using least-privilege and just-in-time elevation to reduce the pool of accounts able to exploit the flaw.

Patch Information

ESET has released updated versions that address the DLL search order issue. Refer to the ESET Security Advisory on DLL Hijacking for the fixed build numbers and update instructions. Apply patches through ESET Protect or the standalone updater across all managed endpoints.

Workarounds

Enforce strict file system ACLs on ESET installation directories to prevent DLL planting by non-SYSTEM accounts.
Enable Windows Defender Application Control or AppLocker policies that block loading of unsigned DLLs from user-writable paths.
Monitor and restrict membership of the local Administrators group, since exploitation requires that privilege level.

bash

# Example: audit ESET install directory ACLs on Windows
icacls "C:\Program Files\ESET\ESET Security"
# Example: list unsigned DLLs loaded by an ESET process using Sysinternals ListDLLs
listdlls.exe -u ekrn.exe