Local Privilege Escalation in Poste Italiane Postecert FIRMAOK! on Windows

CVE-2026-9661

What is CVE-2026-9661?

Poste Italiane's Postecert FIRMAOK! version 1.6.29 for Windows is susceptible to a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. This flaw allows an attacker with low privileges to create a non-existent, writable directory and plant malicious OpenSSL configuration or library files. When the application is executed, it may unintentionally load these attacker-controlled files, enabling them to execute arbitrary code with the privileges of the user running the application. This can lead to significant security breaches, including horizontal and vertical privilege escalations, potentially compromising the entire system.

References