CVE-2026-13133: LINE for Windows DLL Hijacking Vulnerability

CVE-2026-13133 Overview

CVE-2026-13133 is a DLL search path hijacking vulnerability in LineInst.exe, the installer for LINE for Windows versions prior to 26.4.0. The installer loads Msftedit.dll using a relative path without enforcing a secure DLL search order. Attackers can place a malicious Msftedit.dll in the same directory as the installer, causing Windows to load the attacker-supplied library before the legitimate copy in System32. The flaw is tracked under CWE-427: Uncontrolled Search Path Element and requires local access with user interaction.

Critical Impact
A malicious DLL co-located with the LINE for Windows installer executes with the privileges of the user running the installer, resulting in arbitrary code execution.

Affected Products

LINE for Windows (LineInst.exe) versions prior to 26.4.0
Installer package distributed by LINE Corporation for the Windows platform
Environments where users execute LineInst.exe from a directory containing untrusted files (for example, the browser Downloads folder)

Discovery Timeline

2026-08-10 - CVE-2026-13133 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-13133

Vulnerability Analysis

The LINE for Windows installer, LineInst.exe, links against Msftedit.dll, a Microsoft-provided rich edit control library that normally resides in %SystemRoot%\System32. Instead of resolving the module through a hardened search order, the installer requests the DLL by name and permits the default Windows search path to locate it. Under this default behavior, the directory containing the executable is searched before System32. An attacker who drops a crafted Msftedit.dll next to LineInst.exe obtains code execution inside the installer process the moment the victim launches the installer. Because installers are commonly retained in the Downloads folder alongside other downloaded files, the pre-conditions for exploitation are realistic on end-user systems.

Root Cause

The root cause is the failure to call SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH_SYSTEM32 or to load Msftedit.dll via an absolute path. Without these controls, LineInst.exe inherits the legacy DLL search order, which prioritizes the application directory over trusted system locations.

Attack Vector

Exploitation is local and requires user interaction. The attacker must place Msftedit.dll in the same directory as LineInst.exe and then convince the user to execute the installer. Delivery vectors include phishing archives that unpack both files into one folder, drive-by downloads that populate the Downloads directory, or supply-chain tampering of installer bundles. Once the installer runs, the malicious DLL executes with the privileges of the invoking user. See the LINE Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-13133

Indicators of Compromise

Presence of Msftedit.dll in any directory containing LineInst.exe outside of %SystemRoot%\System32
LineInst.exe loading a Msftedit.dll whose file hash does not match the Microsoft-signed system copy
Unexpected child processes spawned by LineInst.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Network connections initiated by LineInst.exe to non-LINE infrastructure during installation

Detection Strategies

Hunt for image-load events (Sysmon Event ID 7) where LineInst.exe loads Msftedit.dll from a path other than C:\Windows\System32
Alert on unsigned or non-Microsoft signed DLLs loaded by installers running from user-writable directories such as Downloads or Temp
Correlate installer execution with immediate creation of persistence artifacts (Run keys, scheduled tasks, or services)

Monitoring Recommendations

Enable process creation and image load auditing on Windows endpoints and forward events to a central analytics platform
Monitor Downloads and Temp directories for co-located executable and DLL pairs that match known DLL hijack patterns
Track digital signature validation failures on DLLs loaded by signed installers

How to Mitigate CVE-2026-13133

Immediate Actions Required

Upgrade LINE for Windows to version 26.4.0 or later before running any new installation or update
Remove older copies of LineInst.exe from Downloads folders and shared file locations across the environment
Instruct users to move installers to an empty, trusted directory before execution

Patch Information

LINE Corporation addressed the issue in LINE for Windows 26.4.0. The fixed installer enforces a secure DLL search path so that Msftedit.dll is resolved from System32 rather than the installer's working directory. Refer to the LINE Security Advisory for the vendor's remediation guidance and download links.

Workarounds

Execute LineInst.exe only from a directory that contains no other user-controlled files, such as a freshly created empty folder
Apply AppLocker or Windows Defender Application Control policies that block DLL loads from user-writable paths
Enforce SmartScreen and Mark-of-the-Web checks so that untrusted archives cannot silently deposit sibling DLLs next to installers

bash

# Verify installed LINE for Windows version and remove stale installer copies
Get-ItemProperty "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "LINE*" } |
  Select-Object DisplayName, DisplayVersion

Get-ChildItem -Path $env:USERPROFILE\Downloads -Filter LineInst.exe -Recurse |
  Remove-Item -Force