CVE-2026-2516: Unidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search path

Security readout for executives and security teams

CVE-2026-2516 is a local DLL search path weakness in Unidocs ezPDF DRM Reader and ezPDF Reader versions 2.0 and 3.0.0.4. If abused, it may let a local attacker make the application load the wrong SHFOLDER.dll. Public exploit material is reported, but active exploitation is not confirmed by KEV or provided sources. Exposure is likely limited to endpoints where Unidocs ezPDF DRM Reader or ezPDF Reader 2.0 or 3.0.0.4 is installed. The attack is local and requires low privileges, reducing broad remote risk but increasing concern on shared workstations, kiosk systems, or environments where untrusted users can access the host. Address in normal high-priority endpoint patching cycles, faster for shared or high-value workstations. This is not a remote worm-like issue based on provided evidence, but public exploit availability and high impact justify timely inventory, upgrade, and monitoring. Mitigation focus: Inventory endpoints for Unidocs ezPDF DRM Reader and ezPDF Reader installations.; Prioritize systems running versions 2.0 or 3.0.0.4.; Upgrade to the latest vendor-provided version where available..

Prepared

Apr 30, 2026, 01:42 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.