CVE-2026-32679: DLL Hijacking in LiveOn Meet and Canon Camera Installers

The National Vulnerability Database has disclosed CVE-2026-32679, a high-severity (CVSS 7.8) DLL hijacking vulnerability affecting installers for LiveOn Meet Client for Windows and Canon Network Camera Plugin. Specifically, Downloader5Installer.exe, Downloader5InstallerForAdmin.exe (LiveOn Meet), CanonNWCamPlugin.exe, and CanonNWCamPluginForAdmin.exe are susceptible.

This flaw allows an attacker to execute arbitrary code with the privileges of the user running the installer. If a malicious DLL is placed in the same directory as the vulnerable installer, the application will insecurely load it. This is a classic CWE-427 issue, demonstrating that fundamental supply chain risks persist even in common software deployment mechanisms.

For defenders, this means a local privilege escalation vector is wide open. An attacker who gains initial low-level access could leverage this to elevate privileges and establish stronger persistence or move laterally. CISOs must ensure endpoint detection and response (EDR) solutions are configured to detect suspicious DLL loads, especially those originating from installer processes. Proactive patching and stringent application control policies are critical to mitigate such vulnerabilities.