Yandex Messenger Uncontrolled Search Path Element Vulnerability Allowing Search Order Hijacking

A vulnerability in Yandex Messenger for Desktop on MacOS, prior to version 2.245, allows for uncontrolled search path elements, leading to search order hijacking. This issue could be exploited by manipulating the application's search path for dynamic libraries, potentially causing the application to load a malicious library instead of the intended one.

Impact

Exploitation of this vulnerability could lead to DLL hijacking, where an attacker could place a malicious DLL in a location that the application is configured to search, causing the application to load and execute the malicious code.

Remediation

Users can update to Yandex Messenger version 2.245 or later to address this vulnerability.