CVE-2026-41447 Overview
CVE-2026-41447 is a DLL hijacking vulnerability in FirmaCheck for Windows before version 1.3.16. The flaw stems from an unvalidated OpenSSL configuration path at C:\Program Files (x86)\Common Files\SSL\. Local attackers can place a crafted openssl.cnf file in that directory to reference an attacker-controlled DLL. When FirmaCheck.exe runs automatically at system startup, the malicious configuration triggers arbitrary code execution at startup process privilege level. The weakness is classified as CWE-426 (Untrusted Search Path).
Critical Impact
Local attackers with low privileges can achieve arbitrary code execution at startup process privilege level by planting a crafted OpenSSL configuration file that loads an attacker-controlled DLL.
Affected Products
- FirmaCheck for Windows versions prior to 1.3.16
- Zucchetti FirmaCheck digital signature management software
- Windows installations where FirmaCheck.exe runs at system startup
Discovery Timeline
- 2026-08-03 - CVE-2026-41447 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-41447
Vulnerability Analysis
FirmaCheck loads OpenSSL configuration from the hardcoded path C:\Program Files (x86)\Common Files\SSL\openssl.cnf without validating the file's integrity or ownership. OpenSSL configuration files support directives that reference external engines and modules via DLL paths. An attacker who can write to the SSL directory can supply an openssl.cnf that instructs OpenSSL to load a malicious DLL. Because FirmaCheck.exe executes automatically at system startup, the injected code runs in the context of the startup process each time the machine boots.
Root Cause
The root cause is an untrusted search path condition ([CWE-426]) combined with reliance on a filesystem location that is not protected against low-privileged write access by default. The application trusts any openssl.cnf present at the fixed path and does not verify that the referenced engine or module DLLs originate from a trusted source. This design allows configuration-directed DLL loading to bypass ordinary code-signing and integrity assumptions.
Attack Vector
Exploitation requires local access with low privileges. The attacker writes a crafted openssl.cnf referencing a malicious DLL into C:\Program Files (x86)\Common Files\SSL\ and places the DLL where the configuration directs. On the next boot or FirmaCheck launch, the OpenSSL library parses the file and loads the attacker-controlled module. The result is arbitrary code execution with the privileges assigned to the startup process, providing a persistence and privilege elevation primitive. Refer to the VulnCheck Security Advisory for technical details.
Detection Methods for CVE-2026-41447
Indicators of Compromise
- Presence of an openssl.cnf file at C:\Program Files (x86)\Common Files\SSL\ on hosts running FirmaCheck
- Unsigned or unexpected DLLs referenced by engine or providers directives within openssl.cnf
- FirmaCheck.exe loading DLLs from user-writable directories or paths outside its install location
Detection Strategies
- Monitor file creation and modification events targeting the C:\Program Files (x86)\Common Files\SSL\ directory
- Correlate FirmaCheck.exe process starts with subsequent DLL image loads that deviate from a known-good baseline
- Alert on any autorun or startup process spawning child processes or loading modules signed by untrusted publishers
Monitoring Recommendations
- Enable Windows Sysmon Event ID 7 (Image Loaded) filtering on FirmaCheck.exe to capture module load telemetry
- Track write access to Common Files\SSL via file integrity monitoring across all Windows endpoints
- Review startup application inventories for FirmaCheck.exe and validate installed version against 1.3.16 or later
How to Mitigate CVE-2026-41447
Immediate Actions Required
- Upgrade FirmaCheck for Windows to version 1.3.16 or later on all affected endpoints
- Audit the C:\Program Files (x86)\Common Files\SSL\ directory for unauthorized openssl.cnf files and remove any not required
- Restrict write permissions on Common Files\SSL to administrators only
Patch Information
The vendor addressed the flaw in FirmaCheck for Windows version 1.3.16. Consult the VulnCheck Security Advisory and the Zucchetti FirmaCheck product page for release information.
Workarounds
- Apply strict NTFS ACLs preventing non-administrative accounts from writing to C:\Program Files (x86)\Common Files\SSL\
- Disable the FirmaCheck automatic startup entry until the patched version is deployed
- Deploy application allowlisting to block unsigned DLLs from loading into FirmaCheck.exe
# Restrict write access to the vulnerable SSL configuration directory
icacls "C:\Program Files (x86)\Common Files\SSL" /inheritance:r
icacls "C:\Program Files (x86)\Common Files\SSL" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
