CVE-2026-110022
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the…
- Risk score
- 51/100
- CVSS
- 8.4 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigne…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.4 high
References
Original description
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.
Last activity 4 Nov 2026. Patch Forecast updates every hour.