Western Digital Patches Critical DLL Hijacking Flaw in WD Discovery for Windows Western Digital has resolved a severe security vulnerability in its WD Discovery desktop application for Windows, which could have allowed attackers to execute arbitrary code on affected systems. The flaw, tracked as CVE-2025-30248, impacts all versions of WD Discovery prior to 5.3 and was patched in December 2025. The vulnerability stems from a DLL search order hijacking issue combined with EXE and DLL hijacking in the application’s Tiny Installer component. By exploiting this flaw, attackers could manipulate the DLL loading process, forcing the application to load malicious libraries instead of legitimate system files. The weakness is classified under CWE-427 (Uncontrolled Search Path Element), a common issue in applications that load DLLs without specifying fully qualified paths. Successful exploitation could enable attackers to execute code with the same privileges as the WD Discovery application, leading to unauthorized data access, malware installation, privilege escalation, or full system compromise. The attack requires user interaction, such as tricking victims into running a malicious installer or opening files from compromised directories potentially via phishing or social engineering. Western Digital released WD Discovery version 5.3 on December 19, 2025, addressing both the DLL search order hijacking and Tiny Installer vulnerabilities. The update is available via automatic prompts, manual download from Western Digital’s official site, or the WD Discovery Online User Guide. The company credited security researchers Kazuma Matsumoto (GMO Cybersecurity by IERAE, Inc.) and David Silva for responsibly disclosing the flaws. Users and organizations are advised to upgrade to version 5.3 or later to mitigate risks. Enterprise security teams should also monitor for unusual DLL loading behavior and enforce application whitelisting to prevent unauthorized code execution.