Uncontrolled search path in Digital Arts Inc. FinalCode Ver.5 series
Priority LOW 38CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file and the installer to the same directory and execute the installer, arbitrary code may be executed with the installer's execution privilege.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed FinalCode Ver.5 series (Digital Arts Inc.): 5.43R01FinalCode Ver.6 series (Digital Arts Inc.): 6.51R01
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Digital Arts Inc. | FinalCode Ver.5 series | before 5.43R01 | 5.43R01 | Patch available | CNA |
| Digital Arts Inc. | FinalCode Ver.6 series | before 6.51R01 | 6.51R01 | Patch available | CNA |
- FinalCode Ver.5 series VendorDigital Arts Inc. Affected before 5.43R01 Fixed in 5.43R01 Patch available CNA
- FinalCode Ver.6 series VendorDigital Arts Inc. Affected before 6.51R01 Fixed in 6.51R01 Patch available CNA
Remediation
- Fix · CNA FinalCode Ver.5 series (Digital Arts Inc.) Fixed in 5.43R01
- Fix · CNA FinalCode Ver.6 series (Digital Arts Inc.) Fixed in 6.51R01
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25191
- 2026-10-03 Alias added: GHSA-jx5h-hvfq-fcgj
References
More Digital Arts Inc. vulnerabilities
- TI-2026-19085 Incorrect default permissions in Digital Arts Inc. FinalCode Ver.5 series CVSS 4.0HIGH 8.5
- TI-2025-35715 Incorrect default permissions in Digital Arts Inc. i-フィルター 6.0 CVSS 4.0HIGH 8.5
- TI-2017-07960 Untrusted search path in Digital Arts Inc. "i-filter 6.0 installer" CVSS 3.0HIGH 7.8
- TI-2025-29738 The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper… CVSS 4.0MEDIUM 6.9
- TI-2017-07959 Untrusted search path in Digital Arts Inc. "i-filter 6.0 installer" CVSS 3.0HIGH 7.8
- TI-2017-07958 Untrusted search path in Digital Arts Inc. "i-filter 6.0 install program" CVSS 3.0HIGH 7.8
Sources
- CVE-2026-25191 · CVE Program
- CVE-2026-25191 · NVD
- FIRST EPSS
- GHSA-jx5h-hvfq-fcgj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences