CVE-2022-46330

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-21 · updated 2026-06-17
Weakness: CWE-427

Description

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

Affected products

Squirrel Installers generated by Squirrel.Windows: through 2.0.1

References

https://github.com/Squirrel/Squirrel.Windows
https://github.com/Squirrel/Squirrel.Windows/pull/1807
https://jvn.jp/en/jp/JVN29902403/index.html
https://github.com/Squirrel/Squirrel.Windows
https://github.com/Squirrel/Squirrel.Windows/pull/1807
https://jvn.jp/en/jp/JVN29902403/index.html

Get alerted when CVE-2022-46330 or the next vulnerability affects your stack