CVE-2024-42190 is a medium severity (CVSS 6.5) vulnerability in HCL Traveler for Microsoft Outlook (HTMO). A DLL hijacking weakness could let an attacker modify or replace the application with malicious content. The record gives no fixed version, so read HCL's knowledge base article KB0120744 and apply the update it names.
What's affected
The NVD record names HCL Traveler for Microsoft Outlook (HTMO) as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0120744. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The vector is local and needs high privileges and user interaction, so the attacker needs a foothold on the workstation first.
How to check if you're exposed
Find out whether you run HCL Traveler for Microsoft Outlook (HTMO) at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0120744.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0120744 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Restrict who can change files in the HTMO install folder and registry keys.
- Check the HTMO install for files you do not recognise, and compare them with a clean install.
- Remove local administrator rights from users who do not need them.
Why it matters
The class is CWE-427, uncontrolled search path element. Windows programs load libraries by name and search a list of folders. If an attacker can place a file with the right name in a folder searched earlier, the program loads the attacker's file and runs it with the user's rights.
The attack is local, which limits who can attempt it, and the score is 6.5. On a shared workstation or a machine where users have broad write access, it is more than theoretical. Application control policies and tight folder permissions are the standard defences, along with the vendor's update.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
What is DLL hijacking?
Placing a malicious library where a program will find it before the real one, so the program loads and runs the attacker's code.
Sources
Last reviewed: 19 October 2026.
