CVE-2026-25191 Other in FinalCode Ver.5 series
A DLL search path vulnerability in the FinalCode Client installer allows arbitrary code execution if a user places a malicious DLL in the installer directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-25191?
CVE-2026-25191 is a high-severity vulnerability in Digital Arts Inc. FinalCode Ver.5 series, published on 26 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file and the installer to the same directory and execute the installer, arbitrary code may be executed with the installer's execution privilege.
Weakness: CWE-427
Which versions are affected by CVE-2026-25191?
How do I fix CVE-2026-25191?
No fix has been published for CVE-2026-25191 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-25191 being exploited?
There is no known exploitation of CVE-2026-25191 in the wild and no public exploit code.
Sources
Also known as GHSA-jx5h-hvfq-fcgj.