What’s Vulnerable › Vulnerabilities

CVE-2023-6235: Arbitrary code execution in Duet Display

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-21 · updated 2026-06-17
• Weakness: CWE-427

Description

An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could place an arbitrary libusk.dll file in the C:\Users\user\AppData\Local\Microsoft\WindowsApps\ directory, which could lead to the execution and persistence of arbitrary code.

Affected products

• Duet Display for Windows 10+: 2.5.9.1

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/arbitrary-code-execution-duet-display
• https://www.incibe.es/en/incibe-cert/notices/aviso/arbitrary-code-execution-duet-display

Get alerted when CVE-2023-6235 or the next vulnerability affects your stack