CVE-2026-18397
2026-10-01
22h17 +00:00
22h17 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component.
The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Improper Handling of Length Parameter Inconsistency The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. |
||
| Unchecked Return Value The product does not check the return value from a method or function. |
||
| Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
||
| Use of Uninitialized Variable The code uses a variable that has not been initialized, leading to unpredictable or unintended results. |
