CVE-2025-40979: DLL search order hijack in Wave by Grandstream Networks

Severity: high (CVSS 7.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-10 · updated 2026-09-30
Weakness: CWE-427

Description

DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\Users<user>\AppData\Local\Temp' directory, which could lead to arbitrary code execution and persistence. This vulnerability is only replicable in versions of Windows 11 and does not affect earlier versions.

Affected products

Grandstream Networks Wave: before 1.27.11 — fixed in 1.27.11

How to fix

Upgrade to a fixed version: Grandstream Networks Wave 1.27.11. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/dll-search-order-hijack-wave-grandstream-networks

Get alerted when CVE-2025-40979 or the next vulnerability affects your stack