I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".

As an example: This application uses libxml2 as a DLL distributed in the application directory (as is "usual" on Windows). The libxml2 version used is somewhat dated, but it covers the use cases of the app. Obviously, libxml2 has it's list of CVEs, but the question I'm asking is: does any of this matter?

There doesn't seem to be an attack vector, other than crashing the app itself (locally), by exploiting any security vulnerabilities of such a library.

So what's the answer if someone claims: "You application is insecure because it uses XYZ!!" when all I do is use XYZ in a local user mode app?

This is not just theoretical: It costs to keep all dependencies up to date in new builds. Users need to be advised if they need to update based on these factors.


... it does not "talk to the internet ...

There is a difference between does not usually talk to the internet or is not able to talk to the internet. As long as the application is not somehow sandboxed or firewalled some exploit can likely make the application talk to the internet.

... this application is a local tool only ...

Just because it runs locally does not mean it does not process data originating from untrusted sources. Even if it does not retrieve the data itself, it might be confronted with such data. Thus the impact of the vulnerability depends on the actual use case, which is unknown.

If the application processes only data fully generated by yourself then there is likely no problem. If instead you feed data into the application from potentially untrusted sources or if the generated data include data from untrusted sources without proper sanitization then there might be a problem, since you no longer have full control over the data.

Note also that the application might be associated with specific file extensions, in which case calling the application with untrusted input might be done by accident.

  • Thanks. Valid angle.
    – Martin
    Apr 1 '21 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.