Loading story…
Western Digital disclosed CVE-2025-30248, a DLL search order hijacking flaw in the WD Discovery desktop app installer on Windows that can allow local arbitrary code execution. The issue affects WD Discovery 5.2.730 and earlier, where an attacker can place a crafted DLL in the installer’s search path so the legitimate installer loads and executes it, running attacker code with the installer’s privileges; the weakness maps to CWE-427.
Western Digital also reported additional EXE/DLL hijacking issues in the product’s Tiny Installer component, increasing the number of potential local execution paths. Western Digital rated the vulnerability HIGH (reported as CVSS v4.0 8.9), and released WD Discovery 5.3 to address the issues; users are advised to update to 5.3 via the application’s update mechanism or by downloading the latest installer from Western Digital’s official site.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Western Digital publicly disclosed the high-severity WD Discovery vulnerability, stating that DLL search order hijacking in the installer could allow local arbitrary code execution on Windows systems. Public reporting also noted the issue affected WD Discovery 5.2.730 and earlier versions and carried a CVSS v4.0 score of 8.9.
An update entry for CVE-2025-30248 was received by Western Digital PSIRT, adding the vulnerability description, CVSS v4.0 vector, CWE-427 classification, and a reference to the vendor advisory. The flaw was described as a DLL hijacking issue in the WD Discovery installer on Windows.
Western Digital released WD Discovery version 5.3 to remediate CVE-2025-30248 and additional EXE/DLL hijacking weaknesses in the Tiny Installer component. The vendor advised users to upgrade immediately from version 5.2.730 and earlier affected versions.
Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. and David Silva responsibly disclosed DLL and related hijacking weaknesses affecting Western Digital's WD Discovery for Windows. The issues included CVE-2025-30248, a DLL search order hijacking flaw in the installer that could enable local arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe disclosed **CVE-2026-48388**, a high-severity flaw in the **Photoshop Installer** caused by an uncontrolled search path element (`CWE-427`). The issue allows a local attacker to place a malicious DLL or library in a directory searched by the installer so that, when a victim runs the installer, attacker-controlled code is loaded and executed in the context of the current user. The vulnerability is not remotely exploitable on its own, but it does require user interaction and can become more serious when installations are performed with elevated privileges. Advisories warn that the installer may search user-writable locations before legitimate Windows system directories, creating a classic **DLL hijacking** condition. Organizations are being urged to update to the latest Adobe Photoshop release containing the patched installer, obtain installers only from official Adobe sources, remove suspicious libraries from searchable paths, enforce application allowlisting and stricter DLL search-order controls, and use least-privilege accounts during software installation.
Jul 30, 2026
A critical DLL hijacking vulnerability, tracked as CVE-2025-56383, was discovered in Notepad++, a widely used text editor. Security researchers identified that the flaw allows attackers to execute arbitrary code on affected systems by exploiting the way Notepad++ loads dynamic link libraries (DLLs). The vulnerability arises when Notepad++ searches for and loads DLL files from directories that can be controlled by an attacker, enabling the introduction of malicious code. Proof-of-concept (PoC) exploit code has been made publicly available, increasing the risk of exploitation by threat actors. The public release of the PoC has heightened concerns within the cybersecurity community, as it lowers the barrier for attackers to leverage this flaw in real-world attacks. The vulnerability is considered severe due to the widespread use of Notepad++ in both personal and enterprise environments. Security advisories have urged users and organizations to apply available patches or implement mitigation strategies to prevent exploitation. The flaw is actively being discussed in security forums, with experts warning that unpatched systems are at significant risk. The technical details of the exploit demonstrate that attackers can gain the same privileges as the user running Notepad++, potentially leading to full system compromise. Security professionals recommend monitoring for suspicious activity related to DLL loading in Notepad++ installations. The vulnerability has been assigned a CVE identifier, underscoring its recognition by the broader security industry. Organizations are advised to review their software inventories to identify vulnerable Notepad++ installations. The availability of the PoC may lead to an increase in automated attacks targeting this flaw. Security vendors are updating their detection signatures to identify exploitation attempts. The incident highlights the ongoing risks associated with DLL hijacking vulnerabilities in popular software applications.
Jun 29, 2026
Researchers detailed a series of local privilege-escalation attacks against antivirus and EDR products that abused **COM hijacking** to load attacker-controlled DLLs into trusted front-end processes and then pivot into privileged back-end services. The work showed a recurring design weakness: low-privileged user-facing components were allowed to issue powerful requests to `SYSTEM` services over named pipes or RPC without sufficient validation. In one generalized attack pattern, modified backend messages were used to write attacker-controlled registry values and alter application paths so that a privileged security process later launched code from a user-writable location, yielding `SYSTEM` access. Product-specific cases expanded that pattern across multiple vendors. **AVG Internet Security** (`CVE-2024-6510`) was exploited by combining COM hijacking, RPC abuse, self-defense disabling, and a TOCTOU race to swap in a malicious DLL for execution as `SYSTEM`; **Webroot Endpoint Protect** (`CVE-2023-7241`) exposed a file-deletion primitive over `\\.\pipe\WRSVCPipe` that was chained into DLL hijacking for a `SYSTEM` shell; **Check Point Harmony** (`CVE-2024-24912`) allowed a privileged service to download a DLL to an attacker-chosen path for lock-screen DLL hijacking; and **Bitdefender Total Security** (`CVE-2023-6154`) let a privileged backend write arbitrary registry values, enabling service `ImagePath` hijacking. The findings echo earlier research on brittle hardening controls in products such as **VirtualBox**, where COM registration abuse and DLL-loading edge cases also undermined process protections.
Jul 24, 2026