CVE-2026-40947: DLL Hijacking in libfido2

The core of this vulnerability lies in the way libfido2 resolves DLL dependencies. If a malicious actor can control the directory where libfido2 searches for DLLs, they can substitute a malicious DLL for a legitimate one. When libfido2 attempts to load a specific function, it will unknowingly load and execute the attacker's code instead. This could lead to privilege escalation, data theft, or even complete system compromise, depending on the attacker's goals and the permissions of the process running libfido2. The impact is magnified if libfido2 is integrated into critical security infrastructure or used in environments with limited access controls. Successful exploitation could allow an attacker to bypass authentication mechanisms or gain unauthorized access to sensitive data.

1. Reserved2026-04-15
2. Published2026-04-15
3. Modified2026-04-16
4. EPSS updated2026-04-23

The primary mitigation for CVE-2026-40947 is to upgrade to the patched versions: libfido2 5.9.1, python-fido2 2.2.0, and yubikey-manager 5.9.1. If immediate upgrading is not possible, consider implementing stricter directory permissions on the libfido2 installation directory to prevent unauthorized file placement. Employing application whitelisting can also restrict the execution of untrusted DLLs. Monitor system logs for unusual DLL loading activity, particularly in the libfido2 installation directory. After upgrading, verify the fix by attempting to load a DLL from a controlled, non-standard location; the library should refuse to load it.