CVE-2026-40947

OVERVIEW CVE-2026-40947 is an unintended DLL search path vulnerability affecting Yubico libfido2 (versions before 1.17.0), python-fido2 (versions before 2.2.0), and yubikey-manager (versions before 5.9.1). This flaw could allow an attacker to potentially load arbitrary dynamic libraries during application execution. SEVERITY The vulnerability carries a CVSS v3.1 score of 2.9 (LOW) with a local attack vector requiring high attack complexity and no user interaction. The impact is limited to integrity compromise, with no confidentiality or availability concerns. The attack requires local access to the affected system, making it a lower-risk threat in most deployment scenarios. EXPLOITATION STATUS There is currently no evidence of active exploitation, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and does not appear on the Hot List. The EPSS score of 0.000050000 reflects minimal probability of exploitation, placing it in the lowest percentile of all CVEs. Community attention remains minimal, though organizations using these Yubico products should apply available patches as part of routine maintenance.