CVE-2026-49308

Publié : 17 août 2026

Modifié : 17 août 2026

Score CVSS

5.5

MEDIUM

Description détaillée

Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Références et Patchs

https://consumer.huawei.com/en/support/bulletin/2026/8/https://consumer.huawei.com/en/support/bulletinlaptops/2026/8/https://consumer.huawei.com/en/support/bulletinvision/2026/8/

Dernières Vulnérabilités

CVE-2026-74901

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

VOIR DÉTAILS

CVE-2026-74900

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.

VOIR DÉTAILS

CVE-2026-74899

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

VOIR DÉTAILS