CVE-2026-18397
2026-10-01
22h17 +00:00
22h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component.
The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Handling of Length Parameter Inconsistency The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. |
||
| Unchecked Return Value The product does not check the return value from a method or function. |
||
| Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
||
| Use of Uninitialized Variable The code uses a variable that has not been initialized, leading to unpredictable or unintended results. |
