Published:2026/06/09  Last Updated:2026/06/09

JVN#27656135
CamView installer insecurely loads Dynamic Link Libraries

Overview

CamView installer provided by ARUCOM Inc. insecurely loads Dynamic Link Libraries.

Products Affected

  • CamView (32-bit) versions prior to 3.3.21
  • CamView (64-bit) versions prior to 3.4.3

Description

CamView installer provided by ARUCOM Inc. insecurely loads Dynamic Link Libraries.

  • Uncontrolled search path element (CWE-427)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
    • CVE-2015-9268
    • The CVSS evaluation above assume that a victim user is directed to download and place a specially crafted DLL file with the affected installer and to execute the installer.

Impact

If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user.

Solution

Use the latest installer
The developer has released the following versions to address the vulnerability.

  • CamView (32-bit version) 3.3.21
  • CamView (64-bit version) 3.4.3

Vendor Status

Vendor Link
ARUCOM Inc. PC Software and Applications | List of User Manuals, Dimension Drawings, and Brochures (Text in Japanese)

References

  1. Japan Vulnerability Notes JVNTA#91240916
    Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia JVNDB-2026-000083