MTG Arena CVE-2026-107448

Requires the attacker to control the server-supplied home-screen carousel content delivered to clients (compromise of the game's content backend or adjacent-network interception of the content channel) - this is the exact 'able to control the carousel content' condition in the description and is the primary limiter, since carousel content is normally server-controlled and not attacker-reachable. Affected: MTGA Windows/Steam client builds 2026.59.30.12801.127931.6 and certain later 2026.60.x builds. Once that precondition is met, no user interaction is needed (UI:N) and the client invokes any registered URI-scheme handler. Realistic impact is further limited by which dangerous scheme handlers are actually registered on the victim host and whether a separately exploitable handler exists to chain against.

This is a genuinely low-priority issue despite the interesting primitive. The provided CVSS is 3.4 (Low) with vector AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, and every available signal agrees it is not an urgent threat: no EPSS score was supplied, it is not on CISA KEV, and no public exploit was flagged in the input (only a single independent researcher write-up is referenced). The dominant limiting factor is baked into AC:H - exploitation is explicitly described as requiring a 'hypothetical attacker able to control the carousel content delivered to clients,' i.e. the attacker must first compromise Wizards of the Coast's server-supplied content pipeline or MITM the content channel, which is a high bar that an ordinary remote attacker does not clear. The scope change (S:C) and 'no user interaction' (UI:N) are the notable aggravators - a controlled carousel entry can silently invoke arbitrary registered URI-scheme handlers on the client - but direct impact is only I:L with C:N and A:N, so the standalone damage is minor unless chained to a separately vulnerable local URI handler. Note the tag 'Information Disclosure' conflicts with the CVSS (C:N means no confidentiality impact); treat that tag as unreliable. Net: a real but conditional integrity flaw, correctly rated Low, not a widespread-exploitation priority.

An attacker who can inject or tamper with the server-supplied home-screen carousel content (via compromise of the content backend or an adjacent-network MITM) delivers a GoToExternalUrl action pointing at a non-https custom URI (e.g. a dangerous registered scheme instead of the expected https: link). Because the client passes the value straight to Application.OpenURL/ShellExecuteW without scheme or domain validation, the registered handler is launched on the victim host with no user interaction, potentially chaining into any locally vulnerable URI-scheme handler. A public vulnerability-research write-up describing the behavior exists, but no weaponized exploit was flagged in the input.