CVE-2026-32679 json
The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Cano…
published 2026-04-23 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-25138
- cvss
- 7.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 5%
- public exploits
- 0
- none known
Summary
The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, the affected installer may load that DLL and execute its code with the privilege of the user invoking the installer.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Japan Media Systems Corporation Downloader5Installer.exe
- Japan Media Systems Corporation Downloader5InstallerForAdmin.exe
- Japan Media Systems Corporation CanonNWCamPlugin.exe
- Japan Media Systems Corporation CanonNWCamPluginForAdmin.exe
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
References
-
web.liveon.ne.jp
/wp-content/uploads/2026/04/JMSSA2026-001.pdf
vendor-advisory
-
jvn.jp
/en/jp/JVN45563482/
third-party-advisory
Sources
- CVE List CVE-2026-32679
- NVD CVE-2026-32679
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.