VAITP Dataset

← Back to the dataset

CVE-2026-40947

Unintended DLL search path in Yubico tools allows code execution.

  • CVSS 2.9
  • CWE-426
  • Configuration Issues
  • Local

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.

CVSS base score
2.9
Published
2026-04-16
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Build/Package/Merge
Code defect classification
Building Issues
Category
Configuration Issues
Subcategory
Dynamic Link Library (DLL) Loading Issues
Accessibility scope
Local
Impact
Arbitrary Code Execution
Affected component
libfido2, py
Fixed by upgrading
Yes

Solution

Upgrade the following components to the specified versions or later: * libfido2 to 1.17.0 * python-fido2 to 2.2.0 * yubikey-manager to 5.9.1

Vulnerable code sample

import ctypes

# On Windows, this call loads the "fido2.dll" library.
# The vulnerability lies in the fact that it does not specify a full path.
# The operating system will search for "fido2.dll" in a series of locations,
# including the current working directory. If an attacker places a malicious
# "fido2.dll" in the same directory as the Python script, this line will
# load and execute the malicious library instead of the legitimate one.
ctypes.cdll.LoadLibrary("fido2")

Patched code sample

import ctypes
import os
import sys

_lib_name = "fido2.dll"

if sys.platform == "win32" and sys.version_info >= (3, 8):
    # Determine the path to the directory containing the bundled DLL.
    # In a real package, this path would point to where the DLL is installed.
    # For this example, we assume it's in a '_lib' subdirectory.
    dll_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "_lib")

    # If the directory exists, add it to the DLL search path.
    # This ensures that Windows will look in this trusted location and not
    # in potentially unsafe locations like the current working directory.
    if os.path.isdir(dll_dir):
        try:
            os.add_dll_directory(dll_dir)
        except (FileNotFoundError, AttributeError):
            # Fallback for edge cases or if the function is unavailable.
            pass

# The vulnerable approach would have just called LoadLibrary directly,
# without the preceding steps to configure a safe search path on Windows.
try:
    # This will now use the secure search path on supported systems.
    lib_fido2 = ctypes.cdll.LoadLibrary(_lib_name)
except OSError:
    lib_fido2 = None

Payload

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    if (fdwReason == DLL_PROCESS_ATTACH) {
        WinExec("calc.exe", SW_SHOWNORMAL);
    }
    return TRUE;
}

Cite this entry

@misc{vaitp:cve202640947,
  title        = {{Unintended DLL search path in Yubico tools allows code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-40947},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-40947/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::