CVE-2022-26319

Vulnerability

CVE-2022-26319 is an installer search path element vulnerability in Trend Micro Portable Security versions 2.0, 3.0, and 3.0 Pro. The installer searches for DLL files in an insecure manner, allowing a local attacker to place a malicious DLL in the installer folder. The vulnerability is present in the installer component and requires the attacker to have prior high-privileged code execution on the target system [1].

Exploitation

An attacker must first obtain the ability to execute high-privileged code on the target system. With that access, the attacker can place a specially crafted DLL file in the installer's search path. When the installer runs, it loads the malicious DLL instead of the legitimate one, leading to code execution in the context of the installer process [1].

Impact

Successful exploitation allows the attacker to elevate privileges, gaining the same high-integrity level as the installer process. This can lead to full compromise of the system, including arbitrary code execution with elevated privileges [1].

Mitigation

Trend Micro has not publicly disclosed a fix or workaround in the available reference [1]. Users should monitor the vendor's advisory page for updates. As of the publication date (2022-03-08), no patch is confirmed. Restricting local access and applying least privilege principles may reduce risk.