Published:2026/10/28  Last Updated:2026/10/28

JVN#23695234
Installer for Yamaha LAN Monitor for Windows may insecurely load Dynamic Link Libraries

Overview

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries.

Products Affected

  • Yamaha LAN Monitor for Windows versions Ver.1.9.3 and earlier

Description

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation contains the following vulnerability, which may result in the insecure loading of Dynamic Link Libraries (DLLs):

  • Uncontrolled search path element (CWE-427)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
    • CVE-2026-103665

Impact

When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.

Solution

Use the latest installer
Use the latest installers which have fixed this issue.
The developer has released the following version to fix the vulnerability:

  • Yamaha LAN Monitor for Windows Ver.1.10.1
Apply the Workaround
The developer recommends the following mitigations for users who cannot use the fixed versions:
  • Use only installers obtained from the official Yamaha website, and do not execute installers obtained from unknown or untrusted sources.
  • Do not use installers included in ZIP files provided by third parties.

Vendor Status

Vendor Link
Yamaha Corporation Installer for Yamaha LAN Monitor for Windows may insecurely load Dynamic Link Libraries (Text in Japanese)

References

  1. Japan Vulnerability Notes JVNTA#91240916
    Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-103665
JVN iPedia