CVE-2026-28704: Emocheck DLL Hijacking RCE Vulnerability

CVE-2026-28704 Overview

CVE-2026-28704 is a DLL Injection vulnerability affecting JPCERT/CC's EmoCheck utility, a tool designed to detect Emotet malware infections. The vulnerability stems from insecure loading of Dynamic Link Libraries (DLLs), allowing attackers to execute arbitrary code by placing a malicious DLL in the same directory as the EmoCheck executable. When a user invokes EmoCheck, the application may inadvertently load the crafted DLL, executing malicious code with the user's privileges.

Critical Impact

Attackers can achieve arbitrary code execution by exploiting the insecure DLL loading behavior, potentially compromising systems during security scanning operations intended to detect Emotet infections.

Affected Products

• JPCERT/CC EmoCheck (versions prior to patched release)

Discovery Timeline

• 2026-04-10 - CVE-2026-28704 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-28704

Vulnerability Analysis

This vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), which occurs when an application searches for critical resources using a search path that can be controlled by untrusted parties. In this case, EmoCheck follows an insecure DLL search order that prioritizes the current working directory or the application's directory when resolving DLL dependencies.

When EmoCheck is executed, Windows follows a standard DLL search order to locate required libraries. If EmoCheck does not explicitly specify absolute paths for its DLL dependencies, the operating system will search multiple locations, including the directory from which the application was launched. An attacker who can place a malicious DLL with a specific name in this directory can hijack the loading process.

The attack requires local access and user interaction—specifically, the victim must execute EmoCheck from a directory containing the attacker's malicious DLL. This scenario is particularly concerning when users download EmoCheck to locations where untrusted files may also reside, such as a Downloads folder.

Root Cause

The root cause of this vulnerability is the application's failure to implement secure DLL loading practices. EmoCheck does not use fully qualified paths when loading DLLs, nor does it employ Windows security features such as SetDefaultDllDirectories() or SetDllDirectory("") to restrict the DLL search path. This allows the Windows loader to search insecure directories, including the application's current working directory, when resolving DLL dependencies.

Attack Vector

The attack vector is local, requiring an attacker to place a malicious DLL file in the same directory as the EmoCheck executable. The attack scenario typically unfolds as follows:

1. An attacker identifies DLL names that EmoCheck attempts to load during execution
2. The attacker crafts a malicious DLL with matching name containing payload code
3. The malicious DLL is placed in a directory where the victim is likely to run EmoCheck (e.g., Downloads folder, shared network location, or extracted archive)
4. When the victim executes EmoCheck, the application loads the malicious DLL instead of the legitimate system DLL
5. Arbitrary code executes with the victim's privileges

This vulnerability is particularly insidious as it targets users who are actively trying to protect their systems from Emotet malware, potentially compromising their security posture during a defensive action.

Detection Methods for CVE-2026-28704

Indicators of Compromise

• Unexpected DLL files appearing in directories alongside EmoCheck executable
• Process monitoring showing EmoCheck loading DLLs from non-system directories
• Unusual child processes spawned by EmoCheck during execution
• Network connections initiated by EmoCheck that are not part of normal operation

Detection Strategies

• Monitor DLL loading events using Windows Event Logging (Sysmon Event ID 7) for EmoCheck processes
• Implement application whitelisting to detect unauthorized DLLs being loaded
• Use SentinelOne's behavioral AI to detect anomalous DLL loading patterns
• Deploy file integrity monitoring on directories where EmoCheck is commonly stored

Monitoring Recommendations

• Enable process creation auditing and DLL loading events via Windows Security Event Log
• Configure endpoint detection rules to alert on DLL loads from user-writable directories
• Implement SentinelOne Singularity to detect and prevent DLL hijacking attempts in real-time
• Regularly audit common download locations for suspicious DLL files

How to Mitigate CVE-2026-28704

Immediate Actions Required

• Download and update to the latest version of EmoCheck from the official JPCERT/CC GitHub repository
• Move EmoCheck to a protected directory (e.g., C:\Program Files\) that requires administrative privileges to modify
• Verify the integrity of EmoCheck downloads using provided checksums before execution
• Remove any unexpected DLL files from directories containing EmoCheck

Patch Information

JPCERT/CC has released updated versions of EmoCheck addressing this vulnerability. Users should download the latest release from the official GitHub EmoCheck Repository and verify the download integrity using the provided SHA-256 checksums. For detailed information about this vulnerability, refer to the JVN #JVN00263243 Advisory and the JPCERT Press Release 2026.

Workarounds

• Execute EmoCheck only from protected directories where non-administrative users cannot write files
• Create a dedicated folder with restricted write permissions for running security tools
• Before running EmoCheck, verify no unexpected DLL files exist in the same directory
• Consider running EmoCheck in an isolated environment or sandbox for additional protection

# Configuration example
# Create a protected directory for EmoCheck and set appropriate permissions
mkdir "C:\Program Files\EmoCheck"
icacls "C:\Program Files\EmoCheck" /inheritance:r
icacls "C:\Program Files\EmoCheck" /grant:r "BUILTIN\Administrators:(OI)(CI)F"
icacls "C:\Program Files\EmoCheck" /grant:r "BUILTIN\Users:(OI)(CI)RX"
# Move EmoCheck to the protected directory
move "%USERPROFILE%\Downloads\emocheck*.exe" "C:\Program Files\EmoCheck\"