CVE-2026-24466
Products provided by Oki Electric Industry Co., Ltd. and its OEM products (Ricoh Co., Ltd., Murata Machinery, Ltd.) register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.4
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.14%
- CWE
- CWE-428
- Published
- 2026-02-09
- Last modified
- 2026-03-12
Affected products
- Oki Electric Industry Co., Ltd. See "References" section
- Ricoh Company, Ltd. See "References" section
- Murata Machinery, Ltd. See "References" section
Weakness type
Related vulnerabilities
- CVE-2026-77827 — Maono Link local privilege escalation
- CVE-2026-66839 — NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path...
- CVE-2026-18755 — GV-ASManager DLL hijacking vulnerability
- CVE-2026-9128 — Studio 5000 Logix Designer® – Multiple Vulnerabilities
- CVE-2026-8864 — HP Fan Control App – Potential Escalation of Privilege
- CVE-2025-71326 — AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation
- CVE-2023-54353 — Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation
- CVE-2022-50971 — Malwarebytes 4.5 Unquoted Service Path Privilege Escalation