CVE-2026-18397
2026-10-01
22h17 +00:00
22h17 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component.
The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Improper Handling of Length Parameter Inconsistency The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. |
||
| Unchecked Return Value The product does not check the return value from a method or function. |
||
| Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
||
| Use of Uninitialized Variable The code uses a variable that has not been initialized, leading to unpredictable or unintended results. |
