DLL Search Order Hijacking in LUCID Vision Labs Arena SDK on Windows

CVE-2026-9169

What is CVE-2026-9169?

This vulnerability in LUCID Vision Labs Arena SDK allows local attackers to exploit a DLL search order hijacking flaw. By placing a malicious DLL in a directory included in the user-controlled PATH environment variable, attackers can execute arbitrary code with the same privileges as the application. The vulnerability arises when the SDK fails to find necessary dependencies locally and traverses the PATH to locate them. This flaw emphasizes the need for secure coding practices and proper validation of loaded libraries to mitigate potential security risks.

References