CVE-2026-13133 LY Corporation CVE debrief

Who should care

Administrators and users of LineInst.exe (LINE for Windows) prior to version 26.4.0 should be aware of this vulnerability and take steps to mitigate it. Affected operators include those responsible for managing and maintaining LineInst.exe (LINE for Windows) deployments. Platform impact includes Windows systems. Vulnerability-management impact includes the need for secure DLL search paths and monitoring system logs for potential exploitation attempts. Security-team impact includes the need for review and mitigation of this vulnerability.

Technical summary

The vulnerability is caused by the insecure loading of Msftedit.dll via a relative path in LineInst.exe (LINE for Windows) prior to version 26.4.0. This allows a malicious DLL to be loaded ahead of the legitimate System32 copy, potentially leading to arbitrary code execution. The vulnerability has a high CVSS score of 8.4, indicating a high severity. Affected product context includes LineInst.exe (LINE for Windows) prior to version 26.4.0. Defensive impact includes the potential for arbitrary code execution and the need for secure DLL search paths.

Defensive priority

High priority due to the high CVSS score of 8.4 and the potential for a malicious DLL to be loaded.

Recommended defensive actions

• Verify the version of LineInst.exe (LINE for Windows) and upgrade to version 26.4.0 or later if necessary.
• Implement secure DLL search paths to prevent malicious DLLs from being loaded.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path. Further investigation is needed to determine the full scope of affected systems and potential mitigations. Affected product deployments should be identified, and owners assigned for follow-up. The vulnerability allows a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy, potentially leading to arbitrary code execution. Defenders should verify system logs for potential exploitation attempts and review compensating controls for exposed systems.

Official resources