CVE-2026-25190
Published: 10 March 2026
Summary
CVE-2026-25190 is a high-severity Untrusted Search Path (CWE-426) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL Search Order Hijacking (T1038); ranked at the 9.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-11 (User-installed Software).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the untrusted search path vulnerability in Windows GDI by requiring timely identification, reporting, and deployment of vendor patches as referenced in Microsoft's update guide.
Enforces secure baseline configuration settings such as Safe DLL Search Mode to prioritize trusted paths and prevent loading of malicious DLLs via GDI's untrusted search path.
Restricts user-installed software to block placement of malicious files in untrusted search paths that a local attacker could exploit through user interaction with GDI.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Untrusted search path (CWE-426) in GDI directly enables DLL search order hijacking/path interception to load attacker-controlled code; exploitation requires user interaction via malicious file (T1204.002).
NVD Description
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-25190 is an untrusted search path vulnerability (CWE-426) in the Windows Graphics Device Interface (GDI). Published on 2026-03-10T18:18:36.300, it carries a CVSS v3.1 base score of 7.8 (High), reflecting local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The flaw affects Windows systems utilizing GDI for graphics rendering.
A local unauthorized attacker can exploit this vulnerability by leveraging the untrusted search path to execute arbitrary code. Exploitation requires tricking a user into performing an action, such as opening a malicious file, but demands no elevated privileges. Upon success, the attacker achieves full local code execution, potentially compromising the victim's system with high severity effects on data access, modification, and disruption.
Microsoft's update guide provides details on mitigation and patching for CVE-2026-25190, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25190. Security practitioners should consult this advisory for deployment instructions and verify system updates.
Details
- CWE(s)