JVN#19505323    
Installer of OM Workspace (Windows Edition) may insecurely load Dynamic Link Libraries

Installer of OM Workspace (Windows Edition) provided by OM Digital Solutions Corporation may insecurely load Dynamic Link Libraries.

• OM Workspace (Windows Edition) Ver 2.4 and earlier

OM Workspace provided by OM Digital Solutions Corporation is image editing software. Installer of OM Workspace (Windows Edition) contains the following vulnerability with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries.

• Uncontrolled search path element (CWE-427)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
  • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-26306
  • This vulnerability is exploited by directing a user to download and place a specially crafted DLL file with the affected installer and execute the installer.

Arbitrary code may be executed with the privilege of the user invoking the installer.

Use the latest installer
Use the latest installer provided by OM Digital Solutions Corporation.
The developer has released the installer that contains a fix for this vulnerability.

Vendor	Link
OM Digital Solutions Corporation	Vulnerability in the OM Workspace Installer

1. Japan Vulnerability Notes JVNTA#91240916
   Insecure DLL Loading and Command Execution Issues on Many Windows Application Programs

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with OM Digital Solutions Corporation under Information Security Early Warning Partnership.