CVE-2026-21427

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running installer.

Metrics

CVSS 4.0 8.5/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-214287.5cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function do CVE-2026-214294.3Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete th CVE-2026-21437.2A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddn CVE-2026-214309.3Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forge CVE-2026-214315.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media libra CVE-2026-214325.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account tak CVE-2026-214337.7Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) request CVE-2026-214347.5webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption i CVE-2026-214357.5webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtranspo CVE-2026-214365.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `CVE-2026-214375.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tr CVE-2026-214385.3webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repea