ClipShare Server Allows Local Privilege Escalation via DLL Hijacking
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search order and loads system libraries like CRYPTBASE.dll and WindowsCodecs.dll from its own directory before the system path. A local, non-privileged user who can write to the folder containing clip_share.exe can place malicious DLLs there, leading to arbitrary code execution in the context of the server, and, if launched by an Administrator (or another elevated user), it results in a reliable local privilege escalation. This vulnerability is fixed in 3.8.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thevindu-w | clip_share_server | before 3.8.5 | 3.8.5 | Patch available | CNA |
- clip_share_server Vendorthevindu-w Affected before 3.8.5 Fixed in 3.8.5 Patch available CNA
Remediation
- Fix · CNA clip_share_server (thevindu-w) Fixed in 3.8.5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49148
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences