SB2026072899 - Remote code execution in Ankitects Anki
Published: July 28, 2026
Security Bulletin ID
SB2026072899
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Insecure DLL loading (CVE-ID: CVE-2025-62185)
CWE-ID: CWE-427 - Uncontrolled Search Path Element
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner. An attacker can place malicious files with names such as youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe in hte media folder and the application will automatically execute them.
Remediation
Install update from vendor's website.