CVE-2024-48091

Tally Prime Edit Log v2.1 contains a DLL hijacking vulnerability via the TextShaping.dll component, classified as CVE-2024-48091 and published on 2025-02-07. This issue, mapped to CWE-427, enables attackers to execute arbitrary code by placing a crafted DLL in a searchable path, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

The vulnerability requires local access (AV:L) and low attack complexity (AC:L), with no privileges needed (PR:N) but user interaction required (UI:R), such as running the affected application in an environment where the malicious DLL can be loaded. A local attacker could exploit this to gain arbitrary code execution at the user's privilege level, potentially leading to full system compromise if the user has administrative rights.

Mitigation details are referenced in advisories, including a technical gist at https://gist.github.com/singhmanpreet493/0f1df7fa4e744a3317877ab85d187937#file-gistfile1-txt and the official Tally Solutions download page at https://tallysolutions.com/download/, where patches or updates may be available.