# DLL search order hijack

Privileged process loads unqualified library or config from a directory a normal user can write

_Area: Memory corruption and native code. Seen in 11 disclosed reports; 8 confirmed bounties, median $250, range $100-$250; latest 2024-08-27. Updated 2026-10-23._

## How it works
A privileged process asks the OS to load a library or config by name, not by absolute path, and the loader resolves that name through a search order that includes directories the invoking user can write. On Windows the DLL search order is the application directory, System32, then the PATH environment variable; User PATH entries such as `%USERPROFILE%\AppData\Local\Microsoft\WindowsApps` and writable SYSTEM PATH entries (e.g. `C:\Python27`) are reachable [E3](https://bugbountylibrary.com/r/h1%3A1010552.md)[E4](https://bugbountylibrary.com/r/h1%3A921675.md)[E6](https://bugbountylibrary.com/r/h1%3A924493.md)[E7](https://bugbountylibrary.com/r/h1%3A1004740.md). On ELF systems the loader honors `LD_LIBRARY_PATH`, and an empty segment means the current directory [E1](https://bugbountylibrary.com/r/h1%3A1073202.md). The broken assumption is "only trusted code can place files where this process looks." When the named file is missing or a writable directory is reached first, the attacker's file loads with the process's privileges. Note E1 and E2 are same-user code execution, not escalation.

## Where it shows up
- Unqualified imports of uncommon or missing DLLs (`tcmalloc.dll`, `ubsec.dll`, `CSUNSAPI.dll`) in elevated binaries [E3](https://bugbountylibrary.com/r/h1%3A1010552.md)[E5](https://bugbountylibrary.com/r/h1%3A1008427.md)[E6](https://bugbountylibrary.com/r/h1%3A924493.md)[E7](https://bugbountylibrary.com/r/h1%3A1004740.md).
- User PATH or SYSTEM PATH entries writable by normal users (`WindowsApps`, `C:\Python27`, Python install path) [E3](https://bugbountylibrary.com/r/h1%3A1010552.md)[E4](https://bugbountylibrary.com/r/h1%3A921675.md)[E5](https://bugbountylibrary.com/r/h1%3A1008427.md)[E6](https://bugbountylibrary.com/r/h1%3A924493.md)[E7](https://bugbountylibrary.com/r/h1%3A1004740.md).
- Config-file loads from compile defaults, e.g. OpenSSL `--openssldir` mapping to `c:\usr\local\ssl` [E2](https://bugbountylibrary.com/r/h1%3A622170.md).
- Generated wrapper scripts with empty or unquoted `LD_LIBRARY_PATH`/`LD_PRELOAD` entries [E1](https://bugbountylibrary.com/r/h1%3A1073202.md).

## How to review
Invariant: every library, config, or helper a privileged process loads must resolve to a path no lower-privileged principal can write, and no untrusted environment variable may influence resolution.

Windows checklist: confirm each load is absolute or its directory is admin-only; enumerate the effective search order (app dir, System32, User PATH, SYSTEM PATH) and test writability as a normal user. Use ProcMon filtered on `NAME NOT FOUND` for config/DLL loads in writable roots [E2](https://bugbountylibrary.com/r/h1%3A622170.md)[E6](https://bugbountylibrary.com/r/h1%3A924493.md)[E7](https://bugbountylibrary.com/r/h1%3A1004740.md).

ELF checklist: confirm `LD_PRELOAD`/`LD_LIBRARY_PATH` are scrubbed and contain no empty segments, and cwd is not attacker-controlled [E1](https://bugbountylibrary.com/r/h1%3A1073202.md).

## Variants seen
- Missing-DLL load via User PATH/WindowsApps [E3](https://bugbountylibrary.com/r/h1%3A1010552.md)[E5](https://bugbountylibrary.com/r/h1%3A1008427.md)[E7](https://bugbountylibrary.com/r/h1%3A1004740.md).
- Writable SYSTEM PATH directory [E6](https://bugbountylibrary.com/r/h1%3A924493.md).
- Writable PATH entry from dev tooling (Python install path) [E4](https://bugbountylibrary.com/r/h1%3A921675.md).
- Compile-default config path hijack (adjacent: config load, not DLL search order) [E2](https://bugbountylibrary.com/r/h1%3A622170.md).
- Empty `LD_LIBRARY_PATH` segment resolving to cwd [E1](https://bugbountylibrary.com/r/h1%3A1073202.md).

## Impact and severity
Normal user to Administrator/SYSTEM [E3](https://bugbountylibrary.com/r/h1%3A1010552.md)[E4](https://bugbountylibrary.com/r/h1%3A921675.md)[E5](https://bugbountylibrary.com/r/h1%3A1008427.md)[E6](https://bugbountylibrary.com/r/h1%3A924493.md)[E7](https://bugbountylibrary.com/r/h1%3A1004740.md). E1 and E2 give code execution as the launching user, not escalation. Severity is high because the trigger is low-privilege file placement in a directory the process already searches.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1073202.md
- E2: https://bugbountylibrary.com/r/h1%3A622170.md
- E3: https://bugbountylibrary.com/r/h1%3A1010552.md
- E4: https://bugbountylibrary.com/r/h1%3A921675.md
- E5: https://bugbountylibrary.com/r/h1%3A1008427.md
- E6: https://bugbountylibrary.com/r/h1%3A924493.md
- E7: https://bugbountylibrary.com/r/h1%3A1004740.md
- E8: https://bugbountylibrary.com/r/h1%3A2215578.md