CVE-2021-31637
Description
An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- UwAmp/UwAmpdescription
Patches
Vulnerability mechanics
Root cause
"DLL hijacking due to the application loading the missing shfolder.dll from the current working directory instead of a safe system path."
Attack vector
An attacker places a malicious shfolder.dll in the same directory as the UwAmp.exe installer. When a victim runs UwAmp.exe, the application attempts to load shfolder.dll and, because the DLL is missing from the expected system location, it loads the attacker-supplied DLL from the current directory [ref_id=1]. This allows the attacker to execute arbitrary code with the privileges of the user running UwAmp, leading to privilege escalation on Windows [ref_id=1].
Affected code
The advisory identifies UwAmp.exe version 3.0.2 as the vulnerable binary [ref_id=1]. The specific code path is not detailed, but the vulnerability lies in the application's DLL loading behavior — it attempts to load shfolder.dll from the current directory rather than from a secure system path [ref_id=1].
What the fix does
The advisory does not include a patch or a fixed version. The recommended mitigation is to avoid loading DLLs from the current working directory [ref_id=1]. No official fix has been published for UwAmp as of the advisory date.
Preconditions
- inputAttacker must place a malicious shfolder.dll in the same directory as UwAmp.exe
- configVictim must run UwAmp.exe from the directory containing the malicious DLL
- configThe application must be run on a Windows system where shfolder.dll is not already present in the search path
Reproduction
1. Use ProcMon to monitor file events. 2. Observe that shfolder.dll is missing from the current directory. 3. Place a malicious DLL named shfolder.dll in the same directory as the installer. 4. Run UwAmp.exe — the installer will load the malicious DLL, leading to arbitrary code execution and privilege escalation [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.