Read the docs
TI-2018-04929 Aliases CVE-2018-6700GHSA-hh85-g72q-6wp5

True Key (TK) - DLL Search Order Hijacking vulnerability

Priority LOW 36CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.

Why it matters now

EPSS 0.00937 61st percentileScored 2026-11-07
Fix Fixed True Key (TK) (McAfee): 5.1.165

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeTrue Key (TK)5.1.165 to before 5.1.1655.1.165Patch availableCNA
  • True Key (TK) VendorMcAfee Affected 5.1.165 to before 5.1.165 Fixed in 5.1.165 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:true_key:*:*:*:*:*:windows:*:*before 5.1.165VulnerableMcAfee
  • cpe:2.3:a:mcafee:true_key:*:*:*:*:*:windows:*:* Versions before 5.1.165 Vulnerable ·McAfee

Remediation

  • Fix · CNA True Key (TK) (McAfee) Fixed in 5.1.165

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6700
  2. 2026-10-03 Alias added: GHSA-hh85-g72q-6wp5

References

Other 1

  • TI-2018-04937 True Key (TK) Windows Client - Privilege Escalation vulnerability CVSS 3.0HIGH 7.8
  • TI-2018-04936 True Key (TK) Windows Client - Authentication Abuse vulnerability CVSS 3.0HIGH 7.8
  • TI-2018-04935 True Key (TK) Windows Client - Weak Directory Permission Vulnerability CVSS 3.0HIGH 7.8
  • TI-2018-04907 TS102801 True Key DLL Side-Loading vulnerability CVSS 3.1HIGH 7.8
  • TI-2018-04920 True Key (TK) - Cross Site Scripting Exposure CVSS 3.1MEDIUM 6.1
  • TI-2019-02663 True Key Browser Extension 3.1.9219.0 update fixes Sensitive Data Exposure vulnerability CVSS 3.0MEDIUM 5.6
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences