CVE-2026-25865: Punto Switcher Unquoted Path Elevation Vulnerability

Technical summary

CVE-2026-25865 is an unquoted search path element vulnerability (CWE-428) in Punto Switcher's invocation of shell32.dll Control_RunDLL input.dll via WinExec. The application fails to provide a fully qualified path to RunDll32.exe, relying instead on the default Windows search order. An unprivileged local attacker can prepend a malicious executable in a predictable search location—such as the current working directory or a directory listed earlier in the PATH environment variable—causing the system to load and execute the attacker's payload in the context of the user running Punto Switcher. The CVSS 3.1 score of 7.8 (HIGH) reflects local vector access, low attack complexity, and high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability poses a moderate but concrete risk for organizations where Punto Switcher is deployed, particularly in shared or multi-user environments. A malicious actor with local system access can escalate privileges or compromise the account of any user running the application, potentially leading to data theft, malware installation, or lateral movement. Organizations relying on Punto Switcher for accessibility or productivity workflows should assess the threat in their threat model and prioritize remediation if the application is used in security-sensitive roles or on systems handling sensitive data.

Affected systems

Punto Switcher versions through 4.5.0.583 are vulnerable. The issue affects any Windows system on which this version or earlier is installed and actively used. Users and systems administrators should verify the installed version via the application's About or Settings dialog and cross-reference against vendor patch availability.

Exploitability

Exploitation requires local access and the ability to write files to a directory in the Windows search path—a plausible scenario for standard users on shared systems, removable media, or environments with weak local access controls. No user interaction or elevated privileges are required once the attacker file is in place; the vulnerability triggers automatically when Punto Switcher executes. Active exploitation in the wild has not been confirmed (the vulnerability is not on the CISA KEV catalog as of the source data date), but the attack is straightforward to execute for anyone with basic Windows knowledge.

Remediation

Users should upgrade Punto Switcher to a patched version released after 4.5.0.583. Verify the latest version directly from the official Punto Switcher vendor website or within the application's update mechanism. Until patching is possible, restrict local system access, disable or uninstall the application if not essential, and monitor for suspicious executable files in common search path directories (Desktop, Downloads, current working directory, etc.).

Patch guidance

Check the official Punto Switcher vendor website or in-application update tool for version information and patch release notes. The vendor should provide clear guidance on which version number resolves CWE-428. If automatic updates are available, enable them. For managed deployments, coordinate patching via your standard software distribution process to ensure all affected instances are remediated. Document the patched version in your asset inventory.

Detection guidance

Monitor for suspicious executable files (.exe, .com, .bat, .cmd, .scr, .vbs) named rundll32.exe or similar in user-writable directories (Desktop, Downloads, AppData, Temp) or earlier in PATH than the legitimate C:\Windows\System32 location. Review process execution logs for RunDll32.exe spawning from unusual parent processes or directories. Endpoint Detection and Response (EDR) or antivirus software configured to detect execution from non-standard paths may alert on exploitation attempts. Regular file integrity monitoring on system PATH directories will help catch suspicious placement.

Why prioritize this

This vulnerability scores HIGH due to the combination of straightforward local exploitation, complete system compromise potential, and presence in a user-facing application that may be widely deployed without strict configuration control. Although active exploitation is not confirmed, the attack is low-complexity and the impact on confidentiality, integrity, and availability is severe. Organizations with Punto Switcher in use should prioritize patching within standard security patch cycles; those in high-security environments should consider immediate remediation or removal.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) is justified by: Attack Vector—Local (AV:L), reflecting the need for pre-existing local access; Attack Complexity—Low (AC:L), because exploitation does not require special conditions or workarounds; Privileges Required—Low (PR:L), as an unprivileged user can exploit; User Interaction—None (UI:N), as the payload executes automatically; Scope—Unchanged (S:U), affecting only the user's own session; Confidentiality, Integrity, Availability—all High (C:H/I:H/A:H), because arbitrary code execution permits full system compromise under that user's context. The score appropriately reflects a serious but local-only threat.

Frequently asked questions