CVE-2021-26807: Gog Galaxy

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentially run code locally through unsigned DLL loading.

Affected products

• Gog Galaxy: version 2.0.28.9 only

Published 2021-04-30. Last modified 2026-06-17.