Read the docs
TI-2018-03792 Aliases CVE-2018-5235GHSA-gmxh-7qg6-9xjm

Uncontrolled search path in Symantec Norton Utilities

Priority LOW 27CWE-427Published · Updated

Key facts

Attack vector
Physical
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.

Why it matters now

EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed Norton Utilities (Symantec Corporation): 16.0.3.44

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Utilitiesbefore 16.0.3.4416.0.3.44Patch availableCNA
  • Norton Utilities VendorSymantec Affected before 16.0.3.44 Fixed in 16.0.3.44 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:norton_utilities:*:*:*:*:*:*:*:*before 16.0.3.44VulnerableSymantec
  • cpe:2.3:a:symantec:norton_utilities:*:*:*:*:*:*:*:* Versions before 16.0.3.44 Vulnerable ·Symantec

Remediation

  • Fix · CNA Norton Utilities (Symantec Corporation) Fixed in 16.0.3.44

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5235
  2. 2026-10-03 Alias added: GHSA-gmxh-7qg6-9xjm

References

Advisory 1

  • TI-2006-01782 Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for… CVSS 2.0MEDIUM 6.8
  • TI-1999-01327 Symantec Norton Utilities 2.0 for Windows 95 marks the TUNEOCX.OCX ActiveX control as… CVSS 2.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences