{"id":"CVE-2026-103665","kind":"vulnerability","aliases":["CVE-2026-103665"],"related":[],"title":"Yamaha LAN Monitor installer for Windows loads malicious DLLs, enabling admin code execution","description":"The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.","summary":"The Windows installer for Yamaha LAN Monitor loads dynamic link libraries from its own directory without checking them, so a crafted DLL placed there gets loaded. The malicious code then runs with administrative privileges.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Yamaha LAN Monitor for Windows","fixed":["1.10.1"],"affected":"<= 1.9.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["dll-hijacking","installer","vendor","windows","yamaha-lan-monitor"],"not_affected_if":["already-installed","installer-not-run"],"how_to_check":"Look for Yamaha LAN Monitor installer files (Ver.1.9.3 or earlier) in downloads folders, network shares or ZIP archives. Check the installer's file version in Properties > Details. Software already installed through a normal install is not affected.","fix":"Use the Yamaha LAN Monitor for Windows installer Ver.1.10.1 or later, downloaded from Yamaha's official site.","status":"open","published_at":"2026-10-29T12:17:08+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:27+00:00","updated_at":"2026-10-29T12:27:53+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-29T12:25:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Yamaha LAN Monitor installer for Windows loads malicious DLLs, enabling admin code execution","impact":"high","summary":"The Windows installer for Yamaha LAN Monitor loads dynamic link libraries from its own directory without checking them, so a crafted DLL placed there gets loaded. The malicious code then runs with administrative privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","yamaha-lan-monitor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code with administrative privileges on Windows","analyst_note":"Confirm affected installer versions and the vendor's fixed version from Yamaha's advisory; NVD entry is the only source given.","how_to_check":"- Check whether Yamaha LAN Monitor for Windows is installed or present in any download folder, using the installer file's name and version as listed by Yamaha.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["installer-not-run"],"who_is_affected":"Exposure depends on running the Yamaha LAN Monitor installer from a directory that may contain a planted DLL, such as a downloads folder or a network share. The sources do not name affected versions or the vendor's remediation. Systems where the installer is never run can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4145,"output_tokens":526,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected installer versions and the vendor's fixed version from Yamaha's advisory; NVD entry is the only source given.","search":"'-103665':16A,19A '-2026':15A,18A 'admin':11A 'administr':67B,114C 'arbitrari':110C 'check':51B 'code':12A,63B,111C 'contain':96C 'corpor':80C 'craft':55B,99C 'cve':14A,17A 'directori':49B,95C 'dll':26B,56B,100C,104C 'dll-hijack':25B 'dlls':9A,87C 'dynam':43B,84C 'enabl':10A 'execut':13A,112C 'file':101C 'for':23A 'get':59B 'hijack':27B 'insecur':82C 'instal':4A,28B,37B,70C,90C 'lan':2A,21A,33B,40B,73C 'launch':92C 'librari':45B,86C 'link':44B,85C 'load':7A,42B,60B,83C,107C 'malici':8A,62B,103C 'may':81C,105C 'monitor':3A,22A,34B,41B,74C 'place':57B 'privileg':68B,115C 'provid':77C 'result':108C 'run':65B 'special':98C 'vendor':29B 'window':6A,30B,36B,76C 'windows':24A 'without':50B 'yamaha':1A,20A,32B,39B,72C,79C 'yamaha-lan-monitor':31B","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs the Yamaha LAN Monitor for Windows installer, Ver.1.9.3 or earlier, from a folder where an attacker could place a DLL (a downloads folder, a shared folder, or an unpacked ZIP from a third party). The DLL then runs with administrator rights. Machines where LAN Monitor is already installed and where the installer is never run again can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T12:27:53Z","by":"analyst","doc":"https://europe.yamaha.com/en/support/updates/yamaha-lan-monitor-win.html","run_id":1025},"products":{"at":"2026-10-29T12:27:53Z","by":"analyst","doc":"https://europe.yamaha.com/en/support/updates/yamaha-lan-monitor-win.html","run_id":1025},"how_to_check":{"at":"2026-10-29T12:27:53Z","by":"analyst","doc":"https://europe.yamaha.com/en/support/updates/yamaha-lan-monitor-win.html","run_id":1025},"who_affected":{"at":"2026-10-29T12:27:53Z","by":"analyst","doc":"https://europe.yamaha.com/en/support/updates/yamaha-lan-monitor-win.html","run_id":1025}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103665","severity":null,"published_at":"2026-10-29T12:17:08+00:00","modified_at":"2026-10-29T12:17:08+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103665:1025","url":null,"severity":null,"published_at":"2026-10-29T12:27:53+00:00","modified_at":"2026-10-29T12:27:53+00:00","first_seen_at":"2026-10-29T12:27:53+00:00","fetched_at":"2026-10-29T12:27:53+00:00","note":"Yamaha's own FAQ (rtpro.yamaha.co.jp) and JVN#23695234: installer Ver.1.9.3 and earlier affected, fixed in Ver.1.10.1. Installer-only issue (CWE-427); installed software not affected. Workaround if cannot upgrade: use only installers from Yamaha's official site, never third-party ZIPs. No exploitation or PoC reported."}],"documents":[{"id":16417,"url":"https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN23695234.html","title":"Yamaha RT Series FAQ / Security: Yamaha LAN Monitor for Windows installer DLL loading","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16418,"url":"https://jvn.jp/en/jp/JVN23695234/","title":"JVN#23695234: Installer for Yamaha LAN Monitor for Windows may insecurely load DLLs","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16419,"url":"https://europe.yamaha.com/en/support/updates/yamaha-lan-monitor-win.html","title":"Yamaha LAN Monitor V1.10.1 for Windows","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}