CVE-2026-68955

Severity: high (CVSS 8.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-14 · updated 2026-09-16
Weakness: CWE-427

Description

The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation.

Affected products

Rakuten Kobo Inc. The installer for Rakuten Kobo Desktop Application (Windows version): Versions distributed before 2026-07-15.

References

https://help.kobo.com/hc/en-us/articles/42294089837463-Security-Advisory-Kobo-Desktop-App-Installer
https://jvn.jp/en/jp/JVN18593874/

Get alerted when CVE-2026-68955 or the next vulnerability affects your stack