CVE-2010-3136

CVE-2010-3136 is an untrusted search path vulnerability affecting Skype version 4.2.0.169 and earlier. It allows local users, and potentially remote attackers, to execute arbitrary code through a DLL hijacking attack. This is achieved by placing a malicious wab32.dll file in the same directory as a .skype file, which the application then loads. The vulnerability carries a critical CVSS score of 9.3, indicating a high potential for complete compromise of confidentiality, integrity, and availability with medium attack complexity. While not listed on the KEV catalog, exploit code for this specific DLL hijacking technique is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.