What is the CVSS score of CVE-2026-4749?

CVE-2026-4749 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Miraclecast are affected by CVE-2026-4749?

Organizations using NVD-CWE-noinfo vulnerability in albfan miraclecast.This should be aware of notable risk from CVE-2026-4749 rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-4749?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Miraclecast CVE-2026-4749

EUVD-2026-14764 MEDIUM

2026-03-24 GovTech CSG

GHSA-cf7x-2rv9-677w

Information Disclosure Miraclecast

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 05:45 euvd

EUVD-2026-14764

Analysis Generated

Mar 24, 2026 - 05:45 vuln.today

Patch released

Mar 24, 2026 - 05:45 nvd

Patch available

CVE Published

Mar 24, 2026 - 05:35 nvd

MEDIUM 6.5

DescriptionCVE.org

NVD-CWE-noinfo vulnerability in albfan miraclecast.This issue affects miraclecast: before v1.0.

AnalysisAI

An information disclosure vulnerability exists in albfan miraclecast before version 1.0 that allows unauthenticated attackers on an adjacent network to access sensitive information. The vulnerability affects miraclecast across all versions prior to v1.0 via an unspecified mechanism (CWE-noinfo). While the CVSS score is 6.5 (medium-high), the attack vector is adjacent network (AV:A) rather than network-wide, and no active exploitation in the wild or known public proof-of-concept has been reported at this time.

Technical ContextAI

Miraclecast is an open-source project maintained by albfan that implements wireless display functionality, likely related to Miracast protocol standards for screen mirroring and display casting. The vulnerability is classified under CWE-noinfo, indicating the specific root cause mechanism has not been publicly disclosed or formally categorized. The affected product is identified by CPE cpe:2.3:a:albfan:miraclecast:*:*:*:*:*:*:*:*, covering all versions of the miraclecast application. The information disclosure nature suggests the vulnerability allows unauthorized reading of sensitive data (possibly credentials, configuration, or session tokens) through an adjacent network without requiring prior authentication or user interaction.

RemediationAI

Upgrade miraclecast to version 1.0 or later, which incorporates the patch from https://github.com/albfan/miraclecast/pull/555. Organizations unable to immediately upgrade should implement network-level mitigations by restricting wireless casting functionality to trusted networks only, disabling miraclecast on systems exposed to untrusted Wi-Fi environments, and applying network segmentation to isolate miraclecast-enabled devices from sensitive network zones. Additionally, audit miraclecast configuration to ensure no sensitive credentials or tokens are exposed through the application interface, and monitor for suspicious adjacent network reconnaissance attempts.