Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.

The installer for Pupsman provided by Fuji Electric Co.,Ltd. contains multiple vulnerabilities listed below:<ul><li>Uncontrolled search path element (CWE-427) - CVE-2026-56437</li><ul><li>The CVSS vectors above assume that a victim user is directed to place a specially crafted DLL file in the same folder as the affected installer and to execute the installer.</li></ul></ul><ul><li>Incorrect default permissions (CWE-276) - CVE-2026-57895</li></ul>Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.