CVE-2026-36574: CactusViewer DLL Hijacking Vulnerability (CVSS 7.8 HIGH)

Technical summary

CVE-2026-36574 is a local privilege escalation vulnerability stemming from improper DLL loading practices (CWE-427: Uncontrolled Search Path Element). CactusViewer v2.3.0 searches for required dynamic libraries without properly validating the library path or restricting search scope, allowing arbitrary code execution. The vulnerability requires local access and user interaction—the application must be executed by a user on an affected system. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the local attack surface, low complexity of exploitation, and complete impact to confidentiality, integrity, and availability.

Business impact

Organizations using CactusViewer v2.3.0 face elevated risk of unauthorized code execution within user contexts. An attacker with local filesystem access could silently inject malicious code, potentially leading to credential theft, lateral movement, data exfiltration, or system compromise. The user-interaction requirement—simply running the application—lowers the barrier for exploitation in social engineering scenarios or multi-stage attacks. Business continuity may be impacted if CactusViewer is integral to workflows; availability impact includes potential system instability or denial of service if the malicious code is designed accordingly.

Affected systems

CactusViewer v2.3.0 from Wassimulator (GitHub) is confirmed affected. Users of this specific version who run the application on Windows systems (DLL hijacking primarily affects Windows environments) are at risk. The vulnerability affects any system where v2.3.0 is installed and executed with user-level or higher privileges. Later versions and alternative applications should be evaluated for similar flaws.

Exploitability

Exploitation is practical and does not require elevated privileges, advanced network capabilities, or a pre-existing foothold—only local filesystem access and the ability to trigger application execution. An attacker can craft a malicious DLL and place it in a predictable search path (e.g., the application's working directory, a shared folder, or system paths where CactusViewer searches before secure locations). Subsequent application launch automatically loads the malicious code. Attack complexity is low, making this vulnerability attractive to both opportunistic and targeted attackers. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of DLL hijacking means functional exploits are likely achievable by competent threat actors.

Remediation

Immediately update CactusViewer to a patched version released after v2.3.0. Verify the updated version against the official Wassimulator GitHub repository to confirm the fix addresses DLL load-path validation. In the interim, restrict execution of CactusViewer to trusted environments and limit local filesystem access on systems where it runs. Audit directories in the DLL search path (particularly the application directory and %PATH%) for unauthorized or suspicious files. Remove the application entirely if it is not essential to operations.

Patch guidance

Check the Wassimulator GitHub repository for CactusViewer releases newer than v2.3.0 and review the changelog for security fixes related to DLL loading or library path validation. Apply the latest stable version to all affected systems. Verify patch application by confirming version numbers post-update and testing application functionality in a non-production environment first. If the vendor has not released a patch, consider alternative tools that provide similar functionality with more secure library loading mechanisms.

Detection guidance

Monitor for suspicious DLL files in directories where CactusViewer is installed or runs, particularly in the application's working directory and subdirectories. Track creation of DLLs with names matching common system libraries (e.g., kernel32.dll, ntdll.dll, msvcrt.dll) in non-standard locations. Enable file integrity monitoring on CactusViewer installation directories to detect unauthorized file additions. Log application execution events and correlate with unexpected process spawning or child processes that indicate code injection. Behavioral analysis tools may flag DLL hijacking attempts by detecting unusual library loading patterns or code execution from unexpected module sources.

Why prioritize this

HIGH CVSS score (7.8) combined with low-complexity local exploitation and user-interaction requirement warrants prompt attention. DLL hijacking is a well-established attack vector with mature tooling; organizations should treat this as a high-priority remediation item. The attack surface—any user on an affected system—is broad. While KEV status is currently negative, the vulnerability's straightforward nature and practical exploitability suggest rapid weaponization is possible. Patch as soon as a tested update is available, and in the interim, enforce application restrictions and monitor execution.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity assessment based on the following factors: local attack vector reduces remote risk but affects all local users; low attack complexity indicates straightforward exploitation; no privilege requirements prior to exploitation; user interaction is required (application execution), but this is a common and easily triggered action; impact to confidentiality, integrity, and availability are all high—arbitrary code execution provides complete system compromise within the user's context. The main mitigating factor is the local scope and user-interaction requirement; however, these do not significantly lower the practical risk in environments where CactusViewer is frequently used or where attackers have filesystem access.

Frequently asked questions