Executive brief
TrueConf Client, a video conferencing and collaboration application, is vulnerable to a security flaw that allows a local attacker to run unauthorized software on a user's computer. By placing a malicious file in specific folders on the system, an attacker can trick the application into executing their code whenever the program starts. This could lead to the theft of personal data, unauthorized access to communications, or a permanent foothold on the infected machine.
Technical details
TrueConf Client 8.5.2 is vulnerable to DLL hijacking (CWE-427) because it attempts to load the library 'wfapi.dll' without specifying an absolute file path. This allows a local, low-privileged attacker to exploit the Windows DLL search order by placing a malicious version of the DLL in a user-writable directory included in the system PATH, such as the WindowsApps folder in the user's AppData directory. When the TrueConf.exe process starts, it loads the attacker's DLL instead of the intended system file, resulting in arbitrary code execution and potential persistence within the context of the logged-in user. The vulnerability was confirmed on Windows 10 22H2. Mitigation involves using absolute paths for library loading and implementing secure DLL search flags via SetDefaultDllDirectories.
Affected products
- TrueConf TrueConf Client 8.5.2
Timeline
- 2025-11-23: disclosed: Vulnerability discovered by Morteza Maleki
- 2025-12-30: advisory: CVE-2025-66835 published