# Codex for Windows: patch project opening from File Explorer

Canonical: https://www.oktsec.com/radar/codex-windows-cve-2026-110930
Publisher: Oktsec
Language: en
Published: 2026-11-07T12:52:55Z
Updated: 2026-11-07T12:52:55Z
Record reviewed: 2026-11-07T12:52:55Z
Latest evidence check: 2026-11-07T12:52:55Z
Disclosed: 2026-11-03

Affected Codex Desktop builds can run attacker code when a Windows 11 user opens a project from a malicious library via File Explorer while Codex is fully closed. OpenAI reports no known abuse in the wild.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: The exploit requires a crafted library, a closed application and specific File Explorer interaction.
- Evidence: No attacks reported
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: OpenAI
- Products: Codex Desktop for Windows
- CVEs: CVE-2026-110930

## Technical overview

On Windows 11, the user must open the attacker's .library-ms file, expand it in File Explorer and select the project opening command from the modern context menu. Codex must be fully closed, with no ChatGPT.exe process running.

Code runs with the current user's permissions, potentially before sign-in or project approval. This advisory does not cover all platforms or ChatGPT generally.

## Recommended response

Update to application 26.1007.21434 or Store package 26.1007.2314.0, or later.

Relevant to: Codex Desktop users on Windows.

## Affected systems and fixes

### Windows application

Affected: 26.820.60940 through 26.1002.52244 inclusive.

Fixed release / action: 26.1007.21434

### Microsoft Store package

Affected: 26.820.7780.0 through 26.1002.7124.0 inclusive.

Fixed release / action: 26.1007.2314.0

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.04
Checked: 2026-11-05T12:14:16.442Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-07T13:37:50.242Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast

- [CVE-2026-110930](https://api.first.org/data/v1/epss?cve=CVE-2026-110930): 0.35% probability of observed exploitation in the next 30 days; percentile 29.21%; score date 2026-11-06.

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-07T13:37:50.242Z.

## Response checklist

1. **Verify the installed version** — Check application or Store package numbering separately.

## Relevance to AI environments

Review developer machines with access to project secrets.

## Sources

- [OpenAI CVE-2026-110930](https://openai.com/security/advisories/cve-2026-110930/) — OpenAI; Vendor notice; checked 2026-11-07T12:52:55Z

## Editorial record

- 2026-11-07T12:52:55Z: Added vendor scope, corrections and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/codex-windows-cve-2026-110930) · [Build a response plan](https://www.oktsec.com/radar/codex-windows-cve-2026-110930#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=codex-windows-cve-2026-110930&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=codex-windows-cve-2026-110930&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.