Executive brief
Rakuten Kobo Desktop Application is a widely-used e-reader management tool for Windows. The installer for this application has a flaw that allows attackers to execute arbitrary code by placing a malicious library file in the same directory as the installer. An attacker could gain the same privileges as the user running the installer, potentially compromising the entire system or stealing sensitive data.
Technical details
The vulnerability is a DLL search path control flaw (CWE-427) in the Kobo Desktop Application installer for Windows. When the installer executes, it uses an uncontrolled search path to locate Dynamic Link Libraries, allowing it to load a malicious DLL from the current working directory rather than only from secure system locations. An attacker must place a specially crafted DLL in the same directory as the installer executable, then convince a user to run the installer from that location. Upon execution, the malicious code runs with the privileges of the installing user. The flaw affects installer versions distributed prior to July 15, 2026, and is not present in the installed application itself. A patch is available by downloading the latest installer version.
Affected products
- Rakuten Kobo Kobo Desktop Application versions prior to July 15, 2026 (Windows installer only)
Timeline
- 2026-08-27: disclosed
- 2026-07-15: patched: Latest installer version fixed