[Japanese]

JVNDB-2026-000110

Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries

Overview

The installer for Rakuten Kobo Desktop Application (Windows version) contains the following vulnerability in the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.
  • Uncontrolled search path element (CWE-427) - CVE-2026-68955
Yukihiro Nakamura reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS v4 Severity
Base Metrics: 8.4 (High) [IPA Score]
  • Access Vector (AV): Local
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): None
  • User Interaction (UI): Active
    • Vulnerable System Impact
  • Confidentiality Impact (VC): High
  • Integrity Impact (VI): High
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
Affected Products


Rakuten Kobo Inc.
  • Rakuten Kobo desktop Application (Windows version) installer distributed before July 15, 2026

Impact

If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation.
Solution

[Use the latest installer]
Use the latest installer provided by the developer.

This vulnerability can only be exploited when the installer is invoked. If the product has already been installed, reinstallation is not required.
Vendor Information

Rakuten Kobo Inc.
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-68955
References

  1. JVN : JVN#18593874
  2. JVN : JVNTA#91240916
Revision History

  • [2026/08/27]
      Web page was published

Date Public2026/08/27
Date First Published2026/08/27
Date Last Updated2026/08/27