Executive brief
FirmaCheck is a digital signature and document management tool used to sign, verify, and timestamp electronic documents. The vulnerability allows a local attacker to achieve arbitrary code execution at system startup by placing a malicious OpenSSL configuration file in an unvalidated directory, potentially compromising all digitally signed documents and enabling unauthorized actions under the system's privileges.
Technical details
The vulnerability is a DLL hijacking attack exploiting an unvalidated search path in FirmaCheck's OpenSSL configuration handling. An attacker with local access can place a crafted openssl.cnf file in the C:\Program Files (x86)\Common Files\SSL\ directory path, which is not properly validated. By referencing an attacker-controlled DLL within the malicious configuration file, arbitrary code execution is achieved when FirmaCheck.exe runs at system startup. The attack requires local access but no elevated privileges, and results in code execution at the privilege level of the startup process. Patches are available in version 1.3.16 and later.
Affected products
- Zucchetti FirmaCheck before 1.3.16
Timeline
- 2026-08-03: disclosed