CVE-2026-26306: OM Workspace DLL Hijacking Vulnerability

CVE-2026-26306 Overview

A DLL hijacking vulnerability exists in the installer for OM Workspace (Windows Edition) Ver 2.4 and earlier versions. The installer insecurely loads Dynamic Link Libraries (DLLs), which allows an attacker to execute arbitrary code with the privileges of the user invoking the installer. This type of vulnerability (CWE-427: Uncontrolled Search Path Element) occurs when the application searches for required DLLs in an insecure manner, enabling attackers to place malicious DLLs in locations where the installer will load them.

Critical Impact
An attacker could execute arbitrary code with the privileges of the user running the installer, potentially leading to complete system compromise if the installer is run with administrative privileges.

Affected Products

OM Workspace (Windows Edition) Ver 2.4
OM Workspace (Windows Edition) all versions earlier than Ver 2.4

Discovery Timeline

2026-03-25 - CVE CVE-2026-26306 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-26306

Vulnerability Analysis

The OM Workspace Windows installer fails to properly specify the locations from which it loads DLL files during execution. When Windows applications load DLLs without specifying an absolute path, the operating system searches for the DLL in a series of directories in a specific order, starting with the application's current directory. This creates an opportunity for attackers to place a malicious DLL with an expected name in a location that gets searched before legitimate system directories.

The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), which describes situations where an application searches for critical resources using an externally-influenced search path that could point to resources outside the intended control sphere. In this case, the installer's DLL loading behavior can be exploited to load attacker-controlled code.

Root Cause

The root cause of this vulnerability is the installer's failure to implement secure DLL loading practices. The OM Workspace installer does not use absolute paths when loading required DLLs, nor does it leverage Windows security features like SetDllDirectory("") or manifest files to control DLL search order. This allows the Windows loader to search for DLLs in directories that may be under attacker control, such as the user's Downloads folder where the installer might be executed from.

Attack Vector

The attack requires local access and user interaction. An attacker must place a malicious DLL with a specific filename in a location where the installer will search for it—typically the same directory as the installer executable or another directory in the search path. When a user downloads and runs the OM Workspace installer, the malicious DLL is loaded and executed with the same privileges as the installer process.

A typical attack scenario involves an attacker distributing a malicious DLL alongside the legitimate installer, perhaps bundled in an archive or placed in a shared network location. When an unsuspecting user extracts and runs the installer, the malicious DLL is automatically loaded, giving the attacker code execution on the victim's system.

Detection Methods for CVE-2026-26306

Indicators of Compromise

Unexpected DLL files present in the same directory as the OM Workspace installer executable
DLL files with suspicious names commonly targeted in DLL hijacking attacks (e.g., version.dll, msvcr*.dll, dwmapi.dll) in user-writable directories
Process creation events showing the OM Workspace installer loading DLLs from non-standard locations

Detection Strategies

Monitor for DLL loading events where the OM Workspace installer (OMWorkspaceSetup.exe or similar) loads DLLs from the same directory as the executable rather than from C:\Windows\System32
Implement application whitelisting to prevent execution of unsigned or untrusted DLLs
Use endpoint detection tools to identify DLL side-loading attempts during software installation processes

Monitoring Recommendations

Enable Windows Event Logging for process creation and DLL loading events (Event IDs 4688 and Sysmon Event ID 7)
Configure SentinelOne to alert on suspicious DLL loading patterns during installer execution
Monitor user Downloads folders and other common attack staging directories for unexpected DLL files

How to Mitigate CVE-2026-26306

Immediate Actions Required

Download the OM Workspace installer only from the official OM System website and verify its integrity before execution
Run installers from a clean, dedicated directory that contains only the installer executable
Avoid running installers directly from compressed archives or shared network locations
Execute the installer with the minimum required privileges to limit potential impact

Patch Information

Users should download the latest version of OM Workspace from the official OM System support page. According to the OM System Camera Support Information, updated versions address this DLL loading vulnerability. The JVN Security Advisory provides additional details about the vulnerability and remediation steps.

Workarounds

Create a new, empty folder and copy only the installer executable to this folder before running it, ensuring no malicious DLLs can be loaded from the same directory
Use Windows Defender Application Control (WDAC) or AppLocker to restrict DLL loading to trusted directories
Consider running the installer in an isolated virtual machine or sandbox environment to contain potential compromise
Enable User Account Control (UAC) to ensure you are aware when the installer requests elevated privileges

bash

# Create a clean installation directory and run the installer safely
mkdir C:\Temp\OMWorkspaceInstall
copy "Downloads\OMWorkspaceSetup.exe" C:\Temp\OMWorkspaceInstall\
cd C:\Temp\OMWorkspaceInstall
.\OMWorkspaceSetup.exe