CVE-2026-18755: GeoVision GV-ASManager DLL Hijacking RCE

CVE-2026-18755 Overview

CVE-2026-18755 is a DLL hijacking vulnerability in GeoVision GV-ASManager, an access control management application. The flaw stems from an unsafe search path [CWE-428] that allows a local attacker with write access to a directory in the application's DLL search order to load a malicious dynamic-link library. When GV-ASManager starts, it loads the attacker-supplied DLL before the legitimate library. The malicious code then executes under the security context of the GV-ASManager process, enabling arbitrary code execution on the host.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the GV-ASManager process, compromising confidentiality, integrity, and availability of the host.

Affected Products

GeoVision GV-ASManager (access control management software)
Windows hosts running the vulnerable GV-ASManager installation
Environments where non-administrative users have write access to directories in the GV-ASManager search path

Discovery Timeline

2026-08-04 - CVE-2026-18755 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18755

Vulnerability Analysis

GV-ASManager loads one or more DLLs by name without specifying a fully qualified path or without restricting the DLL search order. Windows resolves the DLL name using the standard search sequence, which can include directories writable by non-privileged users. An attacker who can drop a file into any earlier directory in that sequence controls which DLL the process loads. Because loading occurs during application startup or feature invocation, no exploitation of memory corruption is required. The malicious DLL executes its DllMain immediately upon load and inherits the token of the GV-ASManager process.

Root Cause

The root cause is an unsafe DLL search path [CWE-428]. The application does not call SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH_SYSTEM32, does not use fully qualified paths in LoadLibrary calls, and does not validate the integrity or origin of loaded modules. This allows any writable directory earlier in the search order to be used as a delivery point for a planted DLL.

Attack Vector

Exploitation requires local access with low privileges and user interaction, typically the launch of GV-ASManager by a legitimate user. The attacker writes a crafted DLL matching the name of a library GV-ASManager loads into an unsafe search directory such as the application's working directory or a writable folder in PATH. When the application starts or triggers the dependent code path, Windows loads the malicious DLL. The exported functions and DllMain of the planted DLL run under the GV-ASManager process context. See the GeoVision Cyber Security Overview for vendor guidance.

Detection Methods for CVE-2026-18755

Indicators of Compromise

Unsigned or unexpected DLL files present in the GV-ASManager installation directory or in writable directories on the system PATH.
DLL modules loaded by GV-ASManager.exe whose file path is outside the standard installation directory or System32.
Newly created DLL files with names matching known GV-ASManager dependencies but with mismatched hashes or missing Authenticode signatures.

Detection Strategies

Monitor process image loads for GV-ASManager.exe and alert when a DLL is loaded from a user-writable path.
Baseline the legitimate DLL set for GV-ASManager and flag deviations in module name, path, or signature.
Correlate file-write events in the application directory with subsequent process starts of GV-ASManager to catch staging activity.

Monitoring Recommendations

Enable Sysmon Event ID 7 (Image Loaded) with filters for GV-ASManager.exe and forward events to a centralized analytics platform.
Audit directory permissions on the GV-ASManager install path and any custom PATH entries on hosts running the application.
Track child process creation from GV-ASManager.exe for anomalous descendants such as cmd.exe, powershell.exe, or rundll32.exe.

How to Mitigate CVE-2026-18755

Immediate Actions Required

Restrict write permissions on the GV-ASManager installation directory and every directory listed in the system PATH so that only administrators can create or modify files.
Inventory all hosts running GV-ASManager and verify that no unsigned or unexpected DLLs exist in the application search path.
Apply vendor updates from GeoVision as soon as a patched release becomes available.

Patch Information

GeoVision publishes security advisories and updates through the GeoVision Cyber Security Overview. Administrators should consult that page for the fixed version of GV-ASManager addressing CVE-2026-18755 and deploy the update across all affected hosts.

Workarounds

Run GV-ASManager under a least-privileged service account and remove write access to the install directory for interactive users.
Enforce application allowlisting (for example Windows Defender Application Control or AppLocker) with a DLL rule set that blocks unsigned modules from loading into GV-ASManager.exe.
Relocate the GV-ASManager installation to a directory outside user-writable paths and remove any writable custom entries from the system PATH.

bash

# Configuration example: audit and lock down the GV-ASManager install directory (PowerShell, run as Administrator)
$Target = 'C:\Program Files (x86)\GeoVision\GV-ASManager'
Get-ChildItem -Path $Target -Filter *.dll -Recurse |
    Get-AuthenticodeSignature |
    Where-Object { $_.Status -ne 'Valid' }

icacls $Target /inheritance:r
icacls $Target /grant:r 'Administrators:(OI)(CI)F' 'SYSTEM:(OI)(CI)F' 'Users:(OI)(CI)RX'