Executive brief
Punto Switcher is a keyboard utility used to automatically switch language layouts. A security flaw allows a local attacker to trick the application into running a malicious file instead of a legitimate Windows system tool. If exploited, an attacker could gain full control over the user's computer, potentially leading to data theft or persistent unauthorized access.
Technical details
Punto Switcher (punto.exe) invokes the Windows keyboard language settings using a WinExec call to 'RunDll32.exe' without specifying a fully qualified directory path. Because the path is unqualified, Windows follows a standard search order to resolve the executable, checking the current working directory and the system PATH before the System32 directory. A local attacker with write access to any directory earlier in the search order can place a malicious 'RunDll32.exe' to achieve arbitrary code execution with the privileges of the Punto Switcher user. This is an instance of CWE-428. As of the advisory date, the vendor has not responded to disclosure attempts, and no patch is confirmed.
Affected products
- Yandex Punto Switcher through 4.5.0.583
Timeline
- 2026-06-17: disclosed: Initial discovery by Spektion Research Team
- 2026-06-18: advisory: CVE-2026-25865 published by VulnCheck/NVD