CVE-2026-11967: Arbitrary code execution in MobaXterm Personal Edition (Portable)

Synopsis

This is a DLL hijacking vulnerability in MobaXterm Personal Edition (Portable) version 26.3 (Build 5154). Because the application loads the winspool.drv library from its own directory at startup without verifying the library's authenticity, a local attacker can drop a malicious DLL with that name into the same folder as the portable executable. When a user then launches MobaXterm, the attacker's code runs under that user's privileges, enabling full arbitrary code execution. A patched-image rebuild at version 26.4 is available on HarborGuard for environments running the affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; the attacker only needs enough access to write a file into the directory containing the portable executable.

• Victim interactionRequired

  The victim must launch the MobaXterm application after the malicious DLL has been placed in the executable's directory, making this a social-engineering or opportunistic local vector.

• Attack complexityDetail

  Attack complexity is low; placing the correctly named DLL alongside the executable is the only precondition, with no race conditions or special environmental factors required.

Blast Radius

• The attacker's DLL executes arbitrary code in the context of the user who launches MobaXterm, giving full read access to that user's files, credentials, and stored SSH/RDP session data.
• The attacker can write or modify files accessible to the victim user, including MobaXterm session configurations, SSH keys, and any data in directories the user owns.
• Running processes owned by the victim user can be tampered with or terminated, and the attacker can install persistent payloads such as scheduled tasks or startup entries under that user account.