Search
Find a vulnerability
Search criteria
14 vulnerabilities by wibu-systems-ag
CVE-2026-81581 (GCVE-0-2026-81581)
Vulnerability from nvd – Published: 2026-08-27 07:46 – Updated: 2026-08-27 15:00
VLAI
EPSS
VEX
Title
User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.
Summary
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:59 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | wibukey |
Affected:
0 , < 6.71
(custom)
cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:* |
Date Public
2025-11-12 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:59:33.139643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:00:55.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/wibukey.html",
"defaultStatus": "unaffected",
"product": "wibukey",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "6.71",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.71",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KEUM SUNG from Team_F1_Driver"
}
],
"datePublic": "2025-11-12T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges)."
}
],
"value": "Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:46:30.828Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100057.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81581",
"datePublished": "2026-08-27T07:46:30.828Z",
"dateReserved": "2026-08-27T07:36:03.335Z",
"dateUpdated": "2026-08-27T15:00:55.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81579 (GCVE-0-2026-81579)
Vulnerability from nvd – Published: 2026-08-27 07:42 – Updated: 2026-08-27 13:08
VLAI
EPSS
VEX
Title
An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
Summary
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:05 UTC
CWE
- CWE-123 - Write-what-where condition
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | wibukey |
Affected:
0 , < 6.71
(custom)
cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:* |
Date Public
2025-11-12 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:05:36.602510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:08:59.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/wibukey.html",
"defaultStatus": "unaffected",
"product": "wibukey",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "6.71",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.71",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "\uae40\uba85\uaddc working with Trend Micro Zero Day Initiative"
}
],
"datePublic": "2025-11-12T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system."
}
],
"value": "In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-123",
"description": "CWE-123 Write-what-where condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:49:17.321Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100031.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81579",
"datePublished": "2026-08-27T07:42:28.626Z",
"dateReserved": "2026-08-27T07:34:49.654Z",
"dateUpdated": "2026-08-27T13:08:59.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81576 (GCVE-0-2026-81576)
Vulnerability from nvd – Published: 2026-08-27 07:14 – Updated: 2026-08-27 13:13
VLAI
EPSS
VEX
Title
Improper Authentication of Session Handles
Summary
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read
license information belonging to another handle.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:10 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.00 Affected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:10:38.008516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:13:33.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.00"
},
{
"status": "affected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\u003cbr\u003eSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\u003cbr\u003elicense information belonging to another handle."
}
],
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\nSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\nlicense information belonging to another handle."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:00:26.426Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authentication of Session Handles",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81576",
"datePublished": "2026-08-27T07:14:11.299Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:13:33.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81575 (GCVE-0-2026-81575)
Vulnerability from nvd – Published: 2026-08-27 07:13 – Updated: 2026-08-27 13:28
VLAI
EPSS
VEX
Title
Missing Sanity Checks for Buffer Lengths
Summary
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a
segmentation fault that ultimately crashes the CodeMeter Runtime.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:27 UTC
CWE
- CWE-130 - Improper handling of length parameter inconsistency
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Unaffected: 7.00 Unaffected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81575",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:27:12.638571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:28:47.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.00"
},
{
"status": "unaffected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and\u003cbr\u003ethe data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a\u003cbr\u003esegmentation fault that ultimately crashes the CodeMeter Runtime."
}
],
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and\nthe data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a\nsegmentation fault that ultimately crashes the CodeMeter Runtime."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper handling of length parameter inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:00:54.182Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Missing Sanity Checks for Buffer Lengths",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81575",
"datePublished": "2026-08-27T07:13:19.937Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:28:47.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81574 (GCVE-0-2026-81574)
Vulnerability from nvd – Published: 2026-08-27 07:11 – Updated: 2026-08-27 13:32
VLAI
EPSS
VEX
Title
Format String Vulnerability in Logger
Summary
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory
and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and
remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this
vulnerability.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:32 UTC
CWE
- CWE-134 - Use of Externally-Controlled format string
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.00 Unaffected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:32:09.372443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:32:50.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.00"
},
{
"status": "unaffected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format\u003cbr\u003especifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory\u003cbr\u003eand stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and\u003cbr\u003eremotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this\u003cbr\u003evulnerability."
}
],
"value": "In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format\nspecifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory\nand stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and\nremotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this\nvulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled format string",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:01:30.061Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Format String Vulnerability in Logger",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81574",
"datePublished": "2026-08-27T07:11:56.916Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:32:50.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81573 (GCVE-0-2026-81573)
Vulnerability from nvd – Published: 2026-08-27 07:09 – Updated: 2026-08-27 13:33
VLAI
EPSS
VEX
Title
Improper Access Control in Local-Only Configuration Commands
Summary
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-
origin restrictions. Commands intended only for local or same-network clients can therefore be executed by
arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values
in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin
takeover.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:33 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.x Affected: 6.x cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.x:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.x:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81573",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:33:30.362029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:33:47.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.x"
},
{
"status": "affected",
"version": "6.x"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.x:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.x:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-\u003cbr\u003eorigin restrictions. Commands intended only for local or same-network clients can therefore be executed by\u003cbr\u003earbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values\u003cbr\u003ein Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin\u003cbr\u003etakeover."
}
],
"value": "If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-\norigin restrictions. Commands intended only for local or same-network clients can therefore be executed by\narbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values\nin Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin\ntakeover."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:56:22.618Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Access Control in Local-Only Configuration Commands",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81573",
"datePublished": "2026-08-27T07:09:09.122Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:33:47.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81572 (GCVE-0-2026-81572)
Vulnerability from nvd – Published: 2026-08-27 07:06 – Updated: 2026-08-27 13:36
VLAI
EPSS
VEX
Title
Local Privilege Escalation in CodeMeter Runtime on Windows
Summary
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and
file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file
operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary
system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted
with System privileges and potentially enable local privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:34 UTC
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
| https://shelltrail.com/research/local-privilege-e… | technical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
8.40 , < 8.41a
(custom)
Affected: 9.00 , < 9.10 (custom) cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81572",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:34:27.207956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:36:14.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.40",
"versionType": "custom"
},
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andreas Vikerup of Shelltrail AB"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "cmu.exe --create-io --file C: creates a predictable temporary file under C:\\CM-Stick. The directory and\u003cbr\u003efile paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file\u003cbr\u003eoperations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary\u003cbr\u003esystem path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted\u003cbr\u003ewith System privileges and potentially enable local privilege escalation."
}
],
"value": "cmu.exe --create-io --file C: creates a predictable temporary file under C:\\CM-Stick. The directory and\nfile paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file\noperations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary\nsystem path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted\nwith System privileges and potentially enable local privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:06:17.884Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103081.pdf"
},
{
"tags": [
"technical-description"
],
"url": "https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Local Privilege Escalation in CodeMeter Runtime on Windows",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81572",
"datePublished": "2026-08-27T07:06:17.884Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:36:14.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81581 (GCVE-0-2026-81581)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:46 – Updated: 2026-08-27 15:00
VLAI
EPSS
VEX
Title
User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.
Summary
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:59 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | wibukey |
Affected:
0 , < 6.71
(custom)
cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:* |
Date Public
2025-11-12 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:59:33.139643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:00:55.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/wibukey.html",
"defaultStatus": "unaffected",
"product": "wibukey",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "6.71",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.71",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "KEUM SUNG from Team_F1_Driver"
}
],
"datePublic": "2025-11-12T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges)."
}
],
"value": "Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:46:30.828Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100057.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service.",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81581",
"datePublished": "2026-08-27T07:46:30.828Z",
"dateReserved": "2026-08-27T07:36:03.335Z",
"dateUpdated": "2026-08-27T15:00:55.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81579 (GCVE-0-2026-81579)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:42 – Updated: 2026-08-27 13:08
VLAI
EPSS
VEX
Title
An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows
Summary
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:05 UTC
CWE
- CWE-123 - Write-what-where condition
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | wibukey |
Affected:
0 , < 6.71
(custom)
cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:* |
Date Public
2025-11-12 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:05:36.602510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:08:59.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/wibukey.html",
"defaultStatus": "unaffected",
"product": "wibukey",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "6.71",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:wibukey:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.71",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "\uae40\uba85\uaddc working with Trend Micro Zero Day Initiative"
}
],
"datePublic": "2025-11-12T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system."
}
],
"value": "In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-123",
"description": "CWE-123 Write-what-where condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:49:17.321Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100031.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81579",
"datePublished": "2026-08-27T07:42:28.626Z",
"dateReserved": "2026-08-27T07:34:49.654Z",
"dateUpdated": "2026-08-27T13:08:59.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81576 (GCVE-0-2026-81576)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:14 – Updated: 2026-08-27 13:13
VLAI
EPSS
VEX
Title
Improper Authentication of Session Handles
Summary
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read
license information belonging to another handle.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:10 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.00 Affected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:10:38.008516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:13:33.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.00"
},
{
"status": "affected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\u003cbr\u003eSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\u003cbr\u003elicense information belonging to another handle."
}
],
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\nSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\nlicense information belonging to another handle."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:00:26.426Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authentication of Session Handles",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81576",
"datePublished": "2026-08-27T07:14:11.299Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:13:33.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81575 (GCVE-0-2026-81575)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:13 – Updated: 2026-08-27 13:28
VLAI
EPSS
VEX
Title
Missing Sanity Checks for Buffer Lengths
Summary
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a
segmentation fault that ultimately crashes the CodeMeter Runtime.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:27 UTC
CWE
- CWE-130 - Improper handling of length parameter inconsistency
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Unaffected: 7.00 Unaffected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81575",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:27:12.638571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:28:47.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "7.00"
},
{
"status": "unaffected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and\u003cbr\u003ethe data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a\u003cbr\u003esegmentation fault that ultimately crashes the CodeMeter Runtime."
}
],
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and\nthe data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a\nsegmentation fault that ultimately crashes the CodeMeter Runtime."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper handling of length parameter inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:00:54.182Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Missing Sanity Checks for Buffer Lengths",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81575",
"datePublished": "2026-08-27T07:13:19.937Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:28:47.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81574 (GCVE-0-2026-81574)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:11 – Updated: 2026-08-27 13:32
VLAI
EPSS
VEX
Title
Format String Vulnerability in Logger
Summary
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory
and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and
remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this
vulnerability.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:32 UTC
CWE
- CWE-134 - Use of Externally-Controlled format string
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.00 Unaffected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:32:09.372443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:32:50.315Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.00"
},
{
"status": "unaffected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format\u003cbr\u003especifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory\u003cbr\u003eand stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and\u003cbr\u003eremotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this\u003cbr\u003evulnerability."
}
],
"value": "In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format\nspecifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory\nand stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and\nremotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this\nvulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled format string",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:01:30.061Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Format String Vulnerability in Logger",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81574",
"datePublished": "2026-08-27T07:11:56.916Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:32:50.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81573 (GCVE-0-2026-81573)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:09 – Updated: 2026-08-27 13:33
VLAI
EPSS
VEX
Title
Improper Access Control in Local-Only Configuration Commands
Summary
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-
origin restrictions. Commands intended only for local or same-network clients can therefore be executed by
arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values
in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin
takeover.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:33 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.x Affected: 6.x cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.x:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.x:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81573",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:33:30.362029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:33:47.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.x"
},
{
"status": "affected",
"version": "6.x"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.x:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.x:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-\u003cbr\u003eorigin restrictions. Commands intended only for local or same-network clients can therefore be executed by\u003cbr\u003earbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values\u003cbr\u003ein Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin\u003cbr\u003etakeover."
}
],
"value": "If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-\norigin restrictions. Commands intended only for local or same-network clients can therefore be executed by\narbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values\nin Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin\ntakeover."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:56:22.618Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Access Control in Local-Only Configuration Commands",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81573",
"datePublished": "2026-08-27T07:09:09.122Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:33:47.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81572 (GCVE-0-2026-81572)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:06 – Updated: 2026-08-27 13:36
VLAI
EPSS
VEX
Title
Local Privilege Escalation in CodeMeter Runtime on Windows
Summary
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and
file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file
operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary
system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted
with System privileges and potentially enable local privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:34 UTC
CWE
- CWE-59 - Improper link resolution before file access ('link following')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
| https://shelltrail.com/research/local-privilege-e… | technical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
8.40 , < 8.41a
(custom)
Affected: 9.00 , < 9.10 (custom) cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81572",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:34:27.207956Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:36:14.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.40",
"versionType": "custom"
},
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andreas Vikerup of Shelltrail AB"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "cmu.exe --create-io --file C: creates a predictable temporary file under C:\\CM-Stick. The directory and\u003cbr\u003efile paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file\u003cbr\u003eoperations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary\u003cbr\u003esystem path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted\u003cbr\u003ewith System privileges and potentially enable local privilege escalation."
}
],
"value": "cmu.exe --create-io --file C: creates a predictable temporary file under C:\\CM-Stick. The directory and\nfile paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file\noperations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary\nsystem path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted\nwith System privileges and potentially enable local privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:06:17.884Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103081.pdf"
},
{
"tags": [
"technical-description"
],
"url": "https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Local Privilege Escalation in CodeMeter Runtime on Windows",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81572",
"datePublished": "2026-08-27T07:06:17.884Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:36:14.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}