⚠️ NEW VULNERABILITY: Japan's JPCERT/CC vulnerability program has disclosed a Windows installer flaw in Rakuten Kobo Desktop that can execute attacker-controlled code with the privileges of the user running the installer. CVE: CVE-2026-68955 CVSS v4: 8.4 HIGH CyberSignal Priority: 🟠 HIGH 📅 August 27, 2026 🏷️ Windows · DLL Hijacking · Software Distribution · Rakuten Kobo 🆔 CVE-2026-68955 🔬 JVN / JPCERT/CC The problem is not inside: the ebook reader itself. It exists in: THE INSTALLATION PROCESS. --- ### 💥 What happens? Affected Kobo Desktop installers use an unsafe: DLL SEARCH PATH. If a malicious DLL is placed in the same directory as the vulnerable installer: victim launches legitimate installer ↓ Windows searches for required DLL ↓ attacker-controlled DLL discovered ↓ malicious DLL loaded ↓ code executes as: THE USER RUNNING THE INSTALLER. This is classic: DLL search-order hijacking. --- ### 🎯 Which installer is affected? JVN says the vulnerability affects Windows installers distributed: BEFORE JULY 15, 2026. The issue is tracked as: CVE-2026-68955 CWE-427 — Uncontrolled Search Path Element. CVSS: 8.4 under CVSS v4 7.8 under CVSS v3. --- ### ⚠️ Important caveat This is NOT: remote unauthenticated RCE. The attacker needs a crafted DLL to already be present in the relevant directory. And: USER INTERACTION IS REQUIRED. The victim must execute the affected installer. JVN also makes another important point: if Kobo Desktop is already installed: YOU DO NOT NEED TO REINSTALL IT. The vulnerable behavior exists when: the installer runs. --- ### 🛡️ Defender takeaway If installing Kobo Desktop on Windows: use the latest installer from the official vendor. For enterprise defenders, this is also a useful hunting pattern: trusted installer + unexpected DLL in download/temp directory + child execution. Attackers often don't need to replace: THE TRUSTED EXECUTABLE. They only need to control: WHAT THE TRUSTED EXECUTABLE LOADS. Sources: Japan Vulnerability Notes · JPCERT/CC · IPA
Post summary
The announcement discloses a DLL search‑order hijacking vulnerability in Rakuten Kobo Desktop installers, provides technical details and mitigation advice, but does not mention PoC, exploit code, or active exploitation.