Critical DLL Search Order Hijacking Vulnerability in LUCID Vision Labs Arena SDK
A high-severity vulnerability (CVE-2026-9169, CVSS 8.8) exists in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows, allowing local attackers to execute arbitrary code with application privileges. The vulnerability is caused by a DLL search order hijacking issue, where the SDK traverses user-controlled directories in the PATH environment variable when a required dependency is not found locally. While not actively exploited, this vulnerability poses a significant risk due to its high impact and local attack vector. Immediate patching or mitigation is recommended.