CVE-2026-104480

Katalog CVE

CVSS 9.4 · Critical EPSS 0,40%

Kerentanan Detection of Error Condition Without Action. Skor CVSS 4.0 9.4 (Critical) menurut CNA.

Deskripsi (NVD)

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.

Rincian

Terbit di NVD

2 Oktober 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 4.0

9.4 (Critical), sumber CNA
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-390: Detection of Error Condition Without Action
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://daveprotocol.com/
• https://github.com/discord/libdave
• https://github.com/discord/libdave/commit/9686fbaea864aa19f0675e486672b6a77811b6a1
• https://github.com/discord/libdave/releases/tag/v1.2.0/cpp