CVE-2026-110930

A crafted Windows library can inject Codex startup arguments

OpenAI · Codex Desktop for Windows

First documented disclosure · Review checkpoint

Summary

Opening a specially prepared library item can run code before sign-in or project approval.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: OpenAI reports no known abuse in the wild. ZDI reports Ikotas Labs’ successful controlled demonstration.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Quotation marks in a project path become additional application startup arguments.

Conditions required

On Windows 11, Codex must be fully closed. The user opens an attacker-provided .library-ms file, expands it in Explorer and chooses Open project in ChatGPT for a child item.

Potential impact

Code runs with the current Windows user’s permissions.

Affected versions and configurations

Application 26.820.60940–26.1002.52244; Store package 26.820.7780.0–26.1002.7124.0, inclusive.

Fix and mitigation status

Application 26.1007.21434; Store package 26.1007.2314.0.

Practical next steps

Update Codex for Windows to the fixed build or a subsequent supported version.

Operating lesson

Enforce launch-argument validation before application trust prompts.

Evidence and limits

ZDI publicly reported the Codex argument-injection demonstration October 6. OpenAI linked that result in its November 3 detailed advisory; the CNA record followed November 5. The reviewed CNA provides no severity score.

Sources