Executive brief
CactusViewer, a lightweight image viewing application, is vulnerable to a security flaw that allows attackers to run unauthorized code on a user's computer. By tricking a user into opening the application from a folder containing a malicious file, an attacker can take control of the user's session and access sensitive data. This typically occurs when the software is distributed in a ZIP file or downloaded into a folder where an attacker has already placed a hidden malicious component.
Technical details
A DLL search order hijacking vulnerability (CWE-427) exists in CactusViewer v2.3.0. The application fails to use absolute paths or secure loading flags when searching for several system and runtime libraries, including D3DCOMPILER_47.dll, d3d11.dll, and dxgi.dll. Because the application searches its own directory before the Windows system directory, a local attacker can place a malicious DLL in the same folder as the executable. When a user launches the application, the malicious DLL is loaded and executed with the privileges of the current user. Remediation involves using LoadLibraryEx with the LOAD_LIBRARY_SEARCH_SYSTEM32 flag or calling SetDllDirectory("") to restrict the search path.
Affected products
- Wassimulator (GitHub) CactusViewer 2.3.0
Timeline
- 2026-02-28: disclosed: Vulnerability reported on GitHub issues
- 2026-06-03: advisory: CVE published to NVD