CVE-2026-13133

This CVE targets DLL hijacking in the LINE installer (LineInst.exe) through Msftedit.dll. The vulnerability exploits Windows' default DLL search path, which checks the application directory before System32 — an attacker with write access to the installer's directory can place a malicious Msftedit.dll that Windows loads instead of the legitimate system DLL. The critical detail most defenders miss: Msftedit.dll is almost certainly loaded transitively by a UI framework component (likely a rich edit control), not by LINE's own code. This means the attack surface is invisible to the developers — there's no import statement or dynamic load call in their codebase they could audit. The vulnerability lives in code they didn't write, linked by frameworks they may not fully understand. To remediate: add SetDllDirectory("") early in your installer initialization to remove the current directory from the DLL search path, or ensure all framework-loaded DLLs are referenced via absolute paths. The fix is one line of code, but the discovery requires instrumentation most installers don't perform — you need to trace what DLLs your UI framework loads under which conditions. The uncomfortable implication: this same transitive DLL loading pattern almost certainly exists in other widely-deployed Windows installers built on similar UI frameworks. This isn't a coding failure unique to LINE — it's a structural trap created by Windows' default behavior combined with invisible dependencies. If you're responsible for any Windows installer, audit your framework's transitive DLL loading, not just your own imports.

Reviewed through automated stages and approved by a human before publication.