Logo
Retour à la veille

CVE-2026-97381

Publié : 13 octobre 2026
Modifié : 13 octobre 2026
Lien officiel NVD
Score CVSS
9.9
CRITICAL

Description détaillée

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033https://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fdhttps://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0https://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgfhttps://legacyupdate.net/news/2026/07/21/legacy-update-1-13-2

Dernières Vulnérabilités

CVE-2026-88964

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

VOIR DÉTAILS

CVE-2026-53564

Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

VOIR DÉTAILS

CVE-2026-53563

Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

VOIR DÉTAILS