A high-severity DLL hijacking vulnerability in the Rakuten Kobo Desktop Application installer for Windows exposes users to arbitrary code execution if a malicious file is present in the local directory.

This vulnerability, categorized as CWE-427, involves the insecure loading of Dynamic Link Libraries (DLLs) during the installation process. An attacker can place a crafted DLL in the same directory as the installer, which the application will then execute with the privileges of the user running the installer.

The potential for arbitrary code execution poses a significant risk to endpoint security, as a successful exploit could lead to full system compromise for the affected user. With a CVSS score of 8.4, this vulnerability is classified as high severity, indicating that it could facilitate unauthorized access to sensitive data or the installation of persistent malware on corporate or personal workstations.

Immediate Action: Users and administrators should ensure they are using the latest version of the Kobo Desktop Application installer released after 2026-07-15. If an older installer is currently in use, it should be deleted immediately to prevent accidental execution.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual process creation events originating from temporary directories or unexpected DLL load requests associated with the Kobo installer.

Compensating Controls: Ensure that users do not have administrative privileges on local machines and enforce strict file system permissions on download directories to prevent unauthorized users from placing malicious files in the application path.

Public Exploit Available: Unknown

Given the high CVSS score, it is imperative to treat this vulnerability as a priority for all Windows-based environments where the Kobo Desktop Application is utilized. Organizations should audit their software deployment workflows to ensure that only verified, updated versions of the installer are used and that users are educated on the risks of executing applications from untrusted or shared directories.