Published:2026/08/10  Last Updated:2026/08/10

JVN#40467227
Installer for LINE for Windows insecurely loads Dynamic Link Libraries

Overview

The installer for LINE for Windows provided by LY Corporation insecurely loads Dynamic Link Libraries.

Products Affected

  • LINE for Windows versions prior to 26.4.0

Description

The installer for LINE for Windows provided by LY Corporation contains the following vulnerability:

  • Uncontrolled search path element (CWE-427)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
    • CVE-2026-13133
    • The CVSS evaluation above assumes that a victim user is directed to download and place a specially crafted DLL file alongside the affected installer and then invoke the installer.

Impact

Arbitrary code may be executed with the privilege of the user invoking the installer.

Solution

Use the latest installer
The developer has released the following version to address the vulnerability.

  • LINE for Windows version 26.4.0

Vendor Status

Vendor Link
LY Corporation CVE-2026-13133

References

  1. Japan Vulnerability Notes JVNTA#91240916
    Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Yukihiro Nakamura reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia JVNDB-2026-000109