CVE-2026-11967

Executive Summary

CVE-2026-11967 is a critical uncontrolled search path element vulnerability (CWE-427) affecting MobaXterm Personal Edition (Portable) version 26.3 (Build 5154). The vulnerability allows an attacker with local access to achieve arbitrary code execution by placing a malicious DLL named winspool.drv in the same directory as the portable executable. When the victim launches MobaXterm, the application automatically loads this DLL from the local directory instead of the system directory, executing the attacker's payload. This is a classic DLL sideloading attack. The vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is high for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone Windows application (MobaXterm) distributed as a portable executable. The attack vector relies on the victim downloading and running the portable version from an untrusted location (e.g., a shared folder, USB drive, or download directory) where an attacker has already placed the malicious DLL.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system or be able to place a file in the same directory as the executable.
• Attack Complexity: Low (AC:L) – No special conditions are required; the DLL is loaded automatically.
• Privileges Required: None (PR:N) – The attacker does not need any privileges to place the DLL.
• User Interaction: Required (UI:R) – The victim must launch the MobaXterm executable.
• Scope: Unchanged (S:U) – The vulnerability does not allow the attacker to affect resources beyond the victim's privilege level.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) – Full compromise of the victim's session.

Threat Level: High. While the EPSS score is low, the vulnerability is trivial to exploit and can lead to complete system compromise if the victim runs the executable from a directory controlled by the attacker.

Deep Dive & Mechanics

The vulnerability is a classic DLL sideloading issue. Windows applications, when loading system DLLs, often search the application's current working directory before searching the system paths (e.g., C:\Windows\System32). MobaXterm Personal Edition (Portable) version 26.3 (Build 5154) attempts to load winspool.drv during startup. Because the application is portable and runs from a user-defined directory, an attacker can place a malicious winspool.drv in that same directory. When the victim launches MobaXterm, Windows loads the attacker's DLL instead of the legitimate system DLL, executing arbitrary code in the context of the victim.

Key Technical Details:

• Vulnerable Component: MobaXterm_Personal_26.3.exe (portable)
• DLL Name: winspool.drv
• Attack Vector: Local file placement
• Privilege Escalation: No – the code runs with the victim's privileges.
• Persistence: Not inherent, but the attacker can achieve persistence by modifying the DLL or using other techniques.

Vulnerable vs. Patched Code

Vulnerable Code (MobaXterm 26.3 Build 5154): The application does not use a secure DLL loading mechanism (e.g., SetDllDirectory("") or using absolute paths). It relies on the default Windows search order, which includes the current directory.

Patched Code (Hypothetical): A patched version would either:

• Use SetDllDirectory("") to remove the current directory from the search order.
• Load winspool.drv using an absolute path (e.g., C:\Windows\System32\winspool.drv).
• Use a manifest to specify a safe search order.

Since no patch is available, no code diff is provided.

Exploitation & Lab Setup

Red Team (Attacker) Setup

Prerequisites:

• Windows machine with MobaXterm Personal Edition 26.3 (Build 5154) portable.
• Ability to write files to the same directory as the MobaXterm executable (e.g., via USB, shared folder, or download).

Steps:

1. Create a malicious DLL named winspool.drv that executes a payload (e.g., reverse shell, keylogger, or privilege escalation).
2. Place the DLL in the same directory as MobaXterm_Personal_26.3.exe.
3. Wait for the victim to launch MobaXterm from that directory.
4. The DLL is loaded, and the payload executes.

Example DLL Code (C++):

// malicious_winspool.cpp
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute payload: spawn calc.exe as a proof of concept
        WinExec("calc.exe", SW_SHOW);
        // In a real attack, this would be a reverse shell or other payload
    }
    return TRUE;
}

Compile with:

x86_64-w64-mingw32-gcc -shared -o winspool.dll malicious_winspool.cpp

Rename the output to winspool.drv.

Blue Team (Defender) Setup

Detection:

• Monitor for winspool.drv being loaded from non-standard paths (e.g., C:\Users\*\AppData\Local\Temp\, C:\Users\*\Downloads\).
• Use Sysmon Event ID 7 (Image loaded) to detect DLL loads.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block DLL sideloading.

Hunting:

• Search for processes loading winspool.drv from directories other than C:\Windows\System32\.
• Look for MobaXterm processes with unusual parent processes (e.g., from a browser or email client).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_11967_MobaXterm_DLL_Sideloading {
    meta:
        description = "Detects malicious winspool.drv DLL used in CVE-2026-11967"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "MobaXterm" nocase
        $s2 = "winspool.drv" nocase
        $s3 = "DLL_PROCESS_ATTACH" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        $s1 and $s2 and $s3
}

Sigma Rule

title: CVE-2026-11967 MobaXterm DLL Sideloading
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects winspool.drv loaded from non-standard paths by MobaXterm
author: Valters IT
date: 2025-04-10
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\winspool.drv'
        Image|endswith: '\MobaXterm_Personal_26.3.exe'
    filter:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter
falsepositives:
    - Legitimate MobaXterm running from system directories (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-11967 MobaXterm DLL Sideloading - Potential Malicious DLL Download";
    flow:to_server,established;
    content:"winspool.drv"; nocase;
    http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Do not run MobaXterm Portable from untrusted directories. Always run it from a secure, controlled location (e.g., C:\Program Files\MobaXterm\).
2. Use the installed version instead of the portable version, as it may have a different DLL loading behavior.
3. Apply Windows Defender ASR rules to block DLL sideloading (Rule GUID: e4dbed2b-3b5a-4d0d-8b4f-944e6c7b8c9a).
4. Monitor for suspicious DLL loads using Sysmon or EDR.

Long-Term Fix:

• The vendor (MobaXterm) must release a patched version that uses secure DLL loading (e.g., SetDllDirectory("") or absolute paths). Until then, users should avoid the portable version.

Workaround:

• Create a symbolic link or junction to redirect winspool.drv to a safe location, but this is not recommended as it may break functionality.

Valters IT