CVE-2026-36574: A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2

Synopsis

A DLL hijacking vulnerability in CactusViewer v2.3.0 (by Wassimulator on GitHub) allows an attacker to plant a crafted DLL file that the application loads in place of a legitimate one. The attack is local, requires no prior authentication, but does require the victim to launch the application. Successful exploitation gives the attacker full code execution with escalated privileges, as well as complete access to read, modify, and disrupt data on the affected host. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationNot required

  No account or credentials are needed before planting the crafted DLL.

• Victim interactionRequired

  The victim must launch CactusViewer, making this a social-engineering or file-delivery scenario where the attacker pre-positions the malicious DLL.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required.

Blast Radius

• Executes arbitrary code in the context of the user who launches CactusViewer, with escalated privileges if the application runs with elevated rights.
• Reads any files or secrets accessible to the hijacked process, including stored credentials and local application data.
• Modifies or deletes files and data on the host that the process has write access to.
• Crashes or disrupts the host application and any dependent services running under the same privilege context.