CVE-2015-0096: microsoft windows_7 Untrusted Search Path

Vulnerability summary

CVE-2015-0096 is a high (CVSS 9.3) Untrusted Search Path vulnerability in microsoft windows_7. EPSS estimates a 70.96% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 11-03-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka "DLL Planting Remote Code Execution Vulnerability."

• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.