HUION Inspiroy Frego S Windows driver: DLL search-path hijacking in installer
Summary
The Windows driver installer 20.0.1.118 for the HUION Inspiroy Frego S (L310) pen tablet reportedly loads VERSION.dll from its own directory instead of a trusted system location. A local attacker who can write a crafted DLL to a directory the installer searches may get code executed in the installer process. The NVD record rates this as High (CVSS 7.8), but the vendor has not confirmed the issue and the researcher's proof of concept is only described, not verified.
Affected
- HUION Inspiroy Frego S (L310) Windows Driver, version 20.0.1.118
- Installer: HuionTabletInstall_20.0.1.118.exe
- Affected DLL: VERSION.dll
Fixed in
Unknown.
- HUION's driver update log lists 20.0.1.109 and older releases but not 20.0.1.118, and the page covers other product branches as well.
- No vendor advisory was found.
Workaround
Unknown.
- Third-party sources suggest removing or disabling the vulnerable installer DLL until a vendor update exists. This was not verified against a vendor source.
- Uninstalling the driver can cause pressure sensitivity and other issues, so this should be tested first.
Exploitation
- No evidence of exploitation in the wild (OffSeq).
- Not listed in CISA KEV; EPSS below 1% (OpenCVE).
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'.
- Whether the linked public gist contains a working proof of concept is unknown.
Our recommendation
- Inventory all HUION devices and check the installed driver version on each Windows endpoint.
- Download drivers only from HUION's official website and do not run unverified installers.
- Remove unnecessary local administrator rights and use application control to restrict which installers can run.
- Consider the risk higher for creative studios or agencies with many tablets and admin users.
- Re-check HUION's advisories and the NVD record, as the record is still deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-107091 disclosure gist gist.github.com
- HUION driver update log www.huion.com
- OpenCVE: CVE-2026-107091 app.opencve.io
- OffSeq threat radar: CVE-2026-107091 radar.offseq.com
- Strix: CVE-2026-107091 www.strix.ai
- HUION Inspiroy Frego S product page www.huion.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:17.
Original description (NVD)
An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.