CVE-2026-23755 D-Link D-View 8 Installer DLL Preloading via Uncontrolled Search Path

What is CVE-2026-23755?

CVE-2026-23755 is a high-severity vulnerability in D-Link D-View 8, published on 21 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious version.dll alongside the legitimate installer so that, when a victim runs the installer and approves the UAC prompt, attacker-controlled code executes with administrator privileges. This can lead to full system compromise.

Weakness: CWE-427

Which versions are affected by CVE-2026-23755?

It affects 1 product.

Products include Dlink D-View 8.

How do I fix CVE-2026-23755?

No fix has been published for CVE-2026-23755 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-23755 being exploited?

There is no known exploitation of CVE-2026-23755 in the wild and no public exploit code.

Other vulnerabilities in D-Link D-View 8

• CVE-2023-7163 D-Link D-View 8 Unauthenticated Probe-Core Server Communication Critical 10.0
• CVE-2024-5296 D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability Critical 9.8
• CVE-2023-32165 D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability Critical 9.8
• CVE-2023-32169 D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability Critical 9.8
• CVE-2023-44411 D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-52pj-q5jq-xr5g.