DLL Search Path Vulnerability in Yubico's libfido2 and Python FIDO2

CVE-2026-40947

What is CVE-2026-40947?

Yubico's libfido2 (versions prior to 1.17.0), python-fido2 (versions prior to 2.2.0), and yubikey-manager (versions prior to 5.9.1) exhibit an unintended DLL search path vulnerability. This flaw could allow an attacker to execute malicious payloads by placing a malicious DLL in a location that is improperly searched by the application. It presents significant potential for exploitation, emphasizing the need for immediate updates to the latest versions to mitigate associated risks.

References