CVE-2026-18397

Katalog CVE

CVSS 9.4 · Critical EPSS 0,34%

Kerentanan Improper Handling of Length Parameter Inconsistency. Skor CVSS 4.0 9.4 (Critical) menurut thalesgroup.com.

Deskripsi (NVD)

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

Rincian

Terbit di NVD

1 Oktober 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Deferred

CVSS 4.0

9.4 (Critical), sumber thalesgroup.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-252: Unchecked Return Value
CWE-347: Improper Verification of Cryptographic Signature
CWE-457: Use of Uninitialized Variable

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.thalesgroup.com/en/product-security-incident-response