---
id: "CVE-2026-103665"
kind: "vulnerability"
aliases: ["CVE-2026-103665"]
title: "Yamaha LAN Monitor installer for Windows loads malicious DLLs, enabling admin code execution"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Yamaha LAN Monitor for Windows", "fixed": ["1.10.1"], "affected": "<= 1.9.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dll-hijacking", "installer", "vendor", "windows", "yamaha-lan-monitor"]
not_affected_if: ["already-installed", "installer-not-run"]
published_at: "2026-10-29T12:17:08+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:27:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103665", "first_seen_at": "2026-10-29T12:24:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:27:53+00:00"}]
---

# Yamaha LAN Monitor installer for Windows loads malicious DLLs, enabling admin code execution

The Windows installer for Yamaha LAN Monitor loads dynamic link libraries from its own directory without checking them, so a crafted DLL placed there gets loaded. The malicious code then runs with administrative privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Yamaha LAN Monitor for Windows affected <= 1.9.3 fixed 1.10.1

## How to check

Look for Yamaha LAN Monitor installer files (Ver.1.9.3 or earlier) in downloads folders, network shares or ZIP archives. Check the installer's file version in Properties > Details. Software already installed through a normal install is not affected.

## Fix

Use the Yamaha LAN Monitor for Windows installer Ver.1.10.1 or later, downloaded from Yamaha's official site.

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103665
- 2026-10-29T12:27:53+00:00 analyst — Yamaha's own FAQ (rtpro.yamaha.co.jp) and JVN#23695234: installer Ver.1.9.3 and earlier affected, fixed in Ver.1.10.1. Installer-only issue (CWE-427); installed software not affected. Workaround if cannot upgrade: use only installers from Yamaha's official site, never third-party ZIPs. No exploitation or PoC reported.

## Documents

- [advisory] Yamaha RT Series FAQ / Security: Yamaha LAN Monitor for Windows installer DLL loading https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVN23695234.html
- [advisory] JVN#23695234: Installer for Yamaha LAN Monitor for Windows may insecurely load DLLs https://jvn.jp/en/jp/JVN23695234/
- [fix] Yamaha LAN Monitor V1.10.1 for Windows https://europe.yamaha.com/en/support/updates/yamaha-lan-monitor-win.html

## From the sources

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_