CVE-2026-8164: ArkSigner Desktop Search Path Vulnerability

CVE-2026-8164 Overview

CVE-2026-8164 is an Uncontrolled Search Path Element vulnerability [CWE-427] in the ArkSigner Desktop Client from ArkSigner Software and Hardware Industry and Trade Inc. The flaw enables Search Order Hijacking on affected installations. Attackers who can place a malicious library in a directory searched by the client can achieve code execution in the context of the signing application. The issue affects ArkSigner Desktop Client versions from v2.2.16.10 through 17062026.

Critical Impact
Local attackers with limited privileges can hijack the library search order to run arbitrary code, compromising confidentiality, integrity, and availability of the host running ArkSigner Desktop Client.

Affected Products

ArkSigner Desktop Client v2.2.16.10
ArkSigner Desktop Client versions between v2.2.16.10 and 17062026
ArkSigner Desktop Client build 17062026

Discovery Timeline

2026-07-28 - CVE-2026-8164 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-8164

Vulnerability Analysis

The ArkSigner Desktop Client loads one or more dependent libraries without fully qualifying their paths. When the application resolves a dependency, it walks an insecure search order that includes directories writable by standard users. An attacker who drops a crafted library with a matching filename into an earlier-searched directory causes the client to load attacker-controlled code. Because the signing client typically runs interactively during document signing workflows, the hijacked code executes with the rights of the user launching the application. The vulnerability requires user interaction, since the victim must run the ArkSigner client for the malicious library to be loaded.

Root Cause

The root cause is Uncontrolled Search Path Element [CWE-427]. The client resolves library dependencies without pinning them to absolute, trusted paths and without validating the origin of loaded modules. Any directory that appears earlier in the resolution order than the legitimate install location becomes a viable plant location for a rogue library.

Attack Vector

Exploitation is local. An attacker first places a malicious library on the target system in a directory that the ArkSigner Desktop Client searches before the legitimate library location. Common plant locations include the application's own working directory, the current user's download folder if used as the launch directory, or writable directories referenced by PATH. When the user launches ArkSigner Desktop Client, the client loads the attacker's library instead of the intended dependency and executes its initialization routines. No verified public exploit code is available at this time. For additional technical detail, see the Siber Güvenlik Notification TR-26-0665.

Detection Methods for CVE-2026-8164

Indicators of Compromise

Unexpected .dll or shared library files present in the ArkSigner install directory, in per-user download folders, or in other directories used to launch the client.
Library files with names matching ArkSigner dependencies but located outside the vendor-managed install path or lacking a valid ArkSigner code signature.
Child processes spawned by the ArkSigner Desktop Client that are inconsistent with normal signing workflows.

Detection Strategies

Monitor image load events for the ArkSigner client process and alert on modules loaded from user-writable directories.
Baseline the set of libraries that ArkSigner Desktop Client legitimately loads and flag deviations, especially unsigned or newly created modules.
Correlate file-write events in user-writable directories with subsequent launches of the ArkSigner Desktop Client from those same directories.

Monitoring Recommendations

Enable process and image-load telemetry on endpoints where ArkSigner Desktop Client is installed, and retain it for retrospective hunting.
Track integrity of files in the ArkSigner install directory with file integrity monitoring.
Review endpoint alerts for anomalous DLL loads by signing and cryptographic client applications.

How to Mitigate CVE-2026-8164

Immediate Actions Required

Inventory endpoints running ArkSigner Desktop Client versions from v2.2.16.10 through 17062026 and prioritize them for remediation.
Instruct users to launch the ArkSigner Desktop Client only from its installed program shortcut, never from a downloads folder or arbitrary working directory.
Restrict write permissions on the ArkSigner install directory to administrators only.

Patch Information

Refer to the Siber Güvenlik Notification TR-26-0665 for vendor guidance and fixed version details. Apply the vendor-supplied update as soon as it is available, and validate that installed builds are newer than 17062026.

Workarounds

Launch ArkSigner Desktop Client only from a controlled, non-writable location and avoid double-clicking files that would set an untrusted current working directory.
Enforce application allowlisting so that only ArkSigner-signed libraries in the vendor install path can be loaded by the client.
Remove unnecessary user-writable entries from the system PATH on hosts that run the ArkSigner client.

bash

# Configuration example: restrict write access to the ArkSigner install directory (Windows)
icacls "C:\Program Files\ArkSigner" /inheritance:r
icacls "C:\Program Files\ArkSigner" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"