Emocheck insecurely loads Dynamic Link Libraries

CVE-2026-28704 is a classic DLL search-order hijack in EmoCheck, JPCERT/CC's Windows utility for checking Emotet infection. Per JVN and the CVE record, all versions are affected: if an attacker can place a crafted DLL in the same directory as the EmoCheck executable and then get a user to run the tool from there, Windows may load the attacker DLL and execute code with the privileges of the user who launched EmoCheck.

The vendor's HIGH 7.8 score is technically defensible in a vacuum because successful execution yields full code execution in the caller's context. In the real world, it is overstated: this is local, user-assisted, non-automatable, tied to a discontinued one-off utility, and has essentially no internet-exposed attack surface. That combination crushes the reachable population and keeps this out of the normal urgent enterprise patch queue.

Why this verdict

• Start at vendor 7.8, then cut for attacker position: this is AV:L and UI:R, so the attacker is not reaching in over the network; they need local placement conditions and a user to run the binary.
• Subtract again for exposure population: EmoCheck is a niche responder utility, not a broadly installed service or agent, and JPCERT/CC ended distribution on 2026-04-10.
• Subtract again for operational evidence: no KEV listing, no active exploitation evidence in the reviewed sources, and the user-provided EPSS is extremely low at 0.00015.

Why not higher?

There is no remote pre-auth path, no server-side listener, and no indication of wormable or automated exploitation. The chain assumes prior delivery success plus user execution of a discontinued tool, which is exactly the kind of compounding friction that drags a CVSS-high local bug down in patch priority.

Why not lower?

This is still real code execution, not a cosmetic bug. If a privileged analyst or admin runs EmoCheck from a writable folder or tainted ZIP extraction path, the DLL executes in that user's context and could turn into a meaningful workstation compromise.

1. Remove EmoCheck wherever it still exists — Because no fixed version is published and the vendor says to stop using it, the cleanest control is retirement. For a LOW noisgate verdict there is no SLA; treat removal as backlog hygiene and close it during your next software-rationalization cycle.
2. Block execution from user-writable folders — Use WDAC, AppLocker, ASR, or equivalent to reduce executable and DLL loading from Downloads, %TEMP%, desktop extraction folders, and ad hoc shares. This is broadly useful beyond this CVE and meaningfully cuts the same-directory sideload condition; for LOW, fold it into normal hardening work with no formal SLA.
3. Hunt for analyst copies and ZIP-based tooling kits — Search responder laptops, admin jump boxes, shared IR folders, and archived incident kits for EmoCheck*.exe. The highest-risk cases are copies sitting in writable directories next to miscellaneous DLLs; again, for LOW, handle in the normal hygiene queue.
4. Alert on unsigned DLL loads next to rare utilities — If you already collect image-load telemetry, create lightweight detections for rare binaries launching from user paths and loading unsigned same-directory DLLs. This does not replace removal, but it gives you a net for residual copies without creating a fire drill.

Run this on the target Windows endpoint or via your EDR/live-response shell. Invoke it as powershell -ExecutionPolicy Bypass -File .\Find-EmoCheck-CVE-2026-28704.ps1 from an elevated session for best coverage across C:\Users, C:\Program Files, and shared tooling directories; standard user rights will work but may return UNKNOWN for protected paths.

# Find-EmoCheck-CVE-2026-28704.ps1

# Detects presence of EmoCheck binaries. All known versions are affected and no fixed version is published.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param(
    [string[]]$SearchRoots = @(
        'C:\Users',
        'C:\Program Files',
        'C:\Program Files (x86)',
        'C:\Tools',
        'C:\Temp'
    )
)

$ErrorActionPreference = 'Continue'
$found = @()
$hadErrors = $false

function Add-FoundFile {
    param([System.IO.FileInfo]$File)

    $version = $null
    try {
        $version = $File.VersionInfo.FileVersion
    } catch {
        $version = $null
    }

    $found += [pscustomobject]@{
        Path = $File.FullName
        Version = if ($version) { $version } else { '' }
        LastWriteTime = $File.LastWriteTime.ToString('s')
    }
}

foreach ($root in $SearchRoots) {
    if (-not (Test-Path -LiteralPath $root)) { continue }

    try {
        Get-ChildItem -LiteralPath $root -Recurse -File -ErrorAction Stop |
            Where-Object {
                $_.Name -match '^EmoCheck.*\.exe$' -or
                $_.Name -match '^emocheck.*\.exe$'
            } |
            ForEach-Object { Add-FoundFile -File $_ }
    } catch {
        Write-Warning ("Could not fully search root: {0} :: {1}" -f $root, $_.Exception.Message)
        $hadErrors = $true

        # Best-effort shallow fallback

        try {
            Get-ChildItem -LiteralPath $root -File -ErrorAction SilentlyContinue |
                Where-Object {
                    $_.Name -match '^EmoCheck.*\.exe$' -or
                    $_.Name -match '^emocheck.*\.exe$'
                } |
                ForEach-Object { Add-FoundFile -File $_ }
        } catch {
            $hadErrors = $true
        }
    }
}

# Deduplicate

$found = $found | Sort-Object Path -Unique

if ($found.Count -gt 0) {
    Write-Output 'VULNERABLE'
    Write-Output 'Detected EmoCheck binaries (all known versions affected; vendor advises discontinuation):'
    $found | ForEach-Object {
        Write-Output ("Path={0}; Version={1}; LastWriteTime={2}" -f $_.Path, $_.Version, $_.LastWriteTime)
    }
    exit 1
}

if ($hadErrors) {
    Write-Output 'UNKNOWN'
    Write-Output 'No EmoCheck binary found in searched paths, but one or more locations could not be fully scanned.'
    exit 2
}

Write-Output 'PATCHED'
Write-Output 'No EmoCheck binary found in the searched paths. Since no fixed version is published, absence is the safe state.'
exit 0

Sources

1. JVN advisory JVN#00263243
2. JPCERT/CC press release ending EmoCheck distribution
3. JPCERTCC/EmoCheck GitHub repository
4. NVD detail for CVE-2026-28704
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS overview
7. Powder Keg Technologies disclosure post