CVE-2026-11967 Overview
CVE-2026-11967 is a DLL hijacking vulnerability in MobaXterm Personal Edition (Portable) version 26.3 (Build 5154). The application automatically loads the winspool.drv library from the executable's directory during startup. An attacker with local access can drop a malicious DLL alongside the portable executable to execute arbitrary code in the victim's context when the application launches. The flaw is tracked under CWE-427 (Uncontrolled Search Path Element).
Critical Impact
Local attackers achieve arbitrary code execution under the victim's user context by placing a crafted winspool.drv next to the MobaXterm portable executable.
Affected Products
- MobaXterm Personal Edition (Portable) version 26.3 Build 5154
- Mobatek MobaXterm portable distributions loading winspool.drv from the executable directory
- Any user environment where the portable binary resides in a writable directory
Discovery Timeline
- 2026-06-12 - CVE-2026-11967 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-11967
Vulnerability Analysis
MobaXterm Personal Edition (Portable) resolves and loads winspool.drv at startup using an insecure search path. Windows applications that call LoadLibrary without specifying an absolute path search the application directory before system directories. When MobaXterm runs from a directory that an attacker can write to, the loader prefers the attacker-supplied DLL over the legitimate Windows print spooler client library in System32. The malicious DLL executes within the MobaXterm process with the privileges of the launching user.
Portable applications amplify this risk because users commonly run them from USB drives, shared folders, or Downloads directories. These locations are frequently writable by standard users or other processes on the host.
Root Cause
The root cause is improper control of the DLL search path during library loading. MobaXterm references winspool.drv without enforcing a fully qualified path or restricting the search order to system directories. Windows' default LoadLibrary behavior treats the application directory as the highest-priority search location, allowing planted DLLs to hijack the import.
Attack Vector
Exploitation requires local access and the ability to write a file to the directory containing the MobaXterm executable. The attacker stages a crafted winspool.drv exporting the symbols the loader expects. When the victim launches MobaXterm, the loader maps the malicious DLL and runs the attacker's DllMain code. No additional user interaction beyond starting the application is required.
The vulnerability mechanism is documented in the INCIBE security notice. No public proof-of-concept code is available at the time of publication.
Detection Methods for CVE-2026-11967
Indicators of Compromise
- Presence of a winspool.drv file in any directory containing MobaXterm.exe outside of C:\Windows\System32
- Unexpected child processes spawned by MobaXterm.exe shortly after launch
- File creation events writing winspool.drv to user-writable paths such as Downloads, Desktop, or removable media
Detection Strategies
- Hunt for image loads of winspool.drv by MobaXterm.exe where the loaded module path is not C:\Windows\System32\winspool.drv
- Alert on writes to filenames matching known Windows system DLLs in non-system directories
- Correlate process creation telemetry to identify portable applications launching from user-controlled locations
Monitoring Recommendations
- Enable Sysmon Event ID 7 (Image Loaded) and filter for system DLL names loaded from non-standard paths
- Audit file write activity in directories that host portable binaries
- Use Singularity Endpoint behavioral AI to flag DLL side-loading patterns and anomalous module loads originating from user-writable directories
How to Mitigate CVE-2026-11967
Immediate Actions Required
- Inventory endpoints for MobaXterm Personal Edition (Portable) 26.3 Build 5154 and identify their installation directories
- Move portable installations to directories writable only by administrators, such as C:\Program Files
- Remove or quarantine any winspool.drv files found alongside MobaXterm executables that did not originate from a trusted source
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Monitor the INCIBE advisory and the Mobatek product page for updated builds addressing the insecure DLL search path. Replace portable deployments with the installer edition where feasible, since it deploys to a protected directory.
Workarounds
- Restrict NTFS permissions on the MobaXterm directory so standard users cannot create or modify files
- Apply AppLocker or Windows Defender Application Control policies to block execution from user-writable paths
- Configure CWDIllegalInDllSearch and use SetDefaultDllDirectories enforcement via group policy or EDR tooling to restrict DLL search locations
# Restrict the MobaXterm portable directory to admins
icacls "C:\Tools\MobaXterm" /inheritance:r
icacls "C:\Tools\MobaXterm" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
# Harden DLL search order machine-wide
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
