Listen to this Post
Intro — How CVE-2026-3091 Works
CVE-2026-3091 is an Uncontrolled Search Path Element vulnerability (CWE-427) impacting Synology Presto Client versions before 2.1.3-0672. The flaw, a classic “DLL preloading” or “DLL planting” weakness, exists in the Windows installer’s dynamic-link library (DLL) loading routine. When the installer executes, it attempts to load several required DLLs to carry out installation tasks. Instead of using a fully qualified, secure path, the installer follows an insecure search order, looking first in its own current working directory before checking system-protected locations. An attacker with local access and low privileges can exploit this by placing a malicious, attacker‑controlled DLL inside the same directory as the legitimate Synology Presto Client installer. When the installer runs from that folder (e.g., a network share, USB drive, or temporary download directory), the installer unknowingly loads the rogue DLL instead of the legitimate one. Once loaded, the malicious code executes with the privileges of the user running the installer, allowing the attacker to read or write arbitrary files on the host and potentially cause a denial‑of‑service. The vulnerability requires user interaction — the victim must execute the installer from the attacker‑controlled folder — which makes it a social‑engineering vector. The NVD‑sourced CVSS v3.1 base score is 7.1 (High) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, while Synology provides a self‑assigned score of 6.7 (Medium) using AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. The vulnerability was publicly disclosed on 24 February 2026, and a fixed version (2.1.3-0672) was made available on the same day.
DailyCVE Form
Platform: Windows
Version: <2.1.3-0672
Vulnerability : uncontrolled search path
Severity: Medium (6.7)
date: 24 Feb 2026
Prediction: Patch available (2.1.3-0672)
What Undercode Say
Undercode says: “Check installer directory for unexpected DLLs before execution. Sysadmins can use the following PowerShell snippet to detect a suspicious `version.dll` (commonly planted payload) alongside `PrestoClientSetup.exe` before allowing the installation.”
Detect suspicious DLL next to installer
$installerPath = "C:\Downloads\PrestoClientSetup.exe"
$dllPath = "C:\Downloads\version.dll"
if (Test-Path $installerPath -and (Test-Path $dllPath)) {
Write-Host "CVE-2026-3091 indicator: rogue DLL in installer directory."
Additionally, check file hash of $dllPath against known good
}
Exploit
No public full Proof‑of‑Concept (PoC) is available at the time of writing. However, a local attacker can pre‑stage any DLL – for example, a custom `version.dll` containing file read/write routines – into the folder that contains the Presto Client installer (e.g., C:\Users\Victim\Downloads\). When the victim runs `PrestoClientSetup.exe` from that folder, the installer loads the malicious DLL, granting the attacker the ability to tamper with any file the victim can access.
Protection
- Upgrade to Synology Presto Client version 2.1.3-0672 or later.
- Restrict local access to systems where Presto Client is deployed.
3. Monitor installation directories for unknown/unexpected `.dll` files.
- Train users not to run installers from untrusted directories (USB drives, shared folders).
- Implement file integrity monitoring on system directories to detect unauthorized file modifications.
Impact
- Confidentiality: An attacker can read any file accessible to the user running the installer (e.g., documents, configuration files).
- Integrity: The attacker can overwrite critical system files or application data, potentially leading to persistent backdoors.
- Availability: By corrupting files or consuming resources, the attacker may cause system instability or a complete denial‑of‑service.
- Scope: The vulnerability is confined to the local system; it does not allow remote exploitation without prior local access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
