PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40947 Yubico CVE debrief

A low-severity vulnerability was found in Yubico libfido2, python-fido2, and yubikey-manager, which have an unintended DLL search path. This issue may allow local attackers to potentially influence the loading of DLLs. The vulnerability affects systems using these libraries, and defenders should assess the exposure of these systems and verify the versions of the affected libraries. The CVE record and NVD entry provide limited information about the vulnerability, and further verification is required to determine the actual impact and affected versions.

Vendor
Yubico
Product
libfido2
CVSS
LOW 2.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-16
Original CVE updated
2026-10-26
Advisory published
2026-04-16
Advisory updated
2026-10-26

Who should care

Defenders responsible for maintaining systems that use Yubico libfido2, python-fido2, and yubikey-manager should assess the exposure of these systems and verify the versions of the affected libraries.

Why it matters

A low-severity vulnerability was found in Yubico libfido2, python-fido2, and yubikey-manager, which have an unintended DLL search path. Defenders should prioritize verifying the versions of these libraries and assessing the exposure of systems that use them.

  • Defenders need to verify the versions of Yubico libfido2, python-fido2, and yubikey-manager in their environments.
  • Systems that use these libraries may be vulnerable to local attacks.

Technical summary

The vulnerability is caused by an unintended DLL search path in Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1. This issue may allow local attackers to potentially influence the loading of DLLs. The affected products are Yubico libfido2, python-fido2, and yubikey-manager, and defenders should prioritize verifying the versions of these libraries in their environments and assess the exposure of systems that use these libraries.

Defensive priority

Defenders should prioritize verifying the versions of Yubico libfido2, python-fido2, and yubikey-manager in their environments and assess the exposure of systems that use these libraries.

Recommended defensive actions

  • Verify the versions of Yubico libfido2, python-fido2, and yubikey-manager in your environment.
  • Assess the exposure of systems that use these libraries.
  • Consider updating to the latest versions of the affected libraries.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the actual impact and affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40947 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40947

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40947 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40947

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.