CorvusSKK CVE-2026-76148

Exploitation requires the target system to be running CorvusSKK prior to version 3.3.4 on Windows 10 (build 14393 or later) or Windows 11. Active user interaction is required (CVSS 4.0 UI:A): the victim must load or trigger processing of a crafted file - most likely a Lua script, configuration file, or similar artifact - through CorvusSKK. The attack vector is local (AV:L), meaning the malicious content must be present on the target machine; network-direct exploitation without prior file delivery is not possible under this vector. No attacker privileges are required (PR:N), but the attacker must successfully deliver the crafted file and socially engineer the user into loading it. Exploitation is not automatable per SSVC, ruling out mass targeting. The primary limiting factor is the requirement for user interaction combined with the niche deployment footprint of a specialized Japanese IME.

The CVSS 4.0 score of 8.4 carries meaningful attenuation signals: AV:L (local attack vector) and UI:A (active user interaction required) together rule out remote unauthenticated or automated exploitation. EPSS at 0.21% (11th percentile) is consistent with SSVC's 'Exploitation: none' and 'Automatable: no' ratings, indicating no known active exploitation and no feasible mass-scanning or worm-propagation scenario. These signals are internally consistent - there are no conflicting data points between CVSS, EPSS, and SSVC. Despite low exploitation probability, SSVC's 'Technical Impact: total' and the CVSS 4.0 VC:H/VI:H/VA:H ratings confirm that successful exploitation yields full compromise of the vulnerable system. The practical risk profile is therefore: low likelihood of opportunistic exploitation, but high-severity outcome if a targeted attack is executed via social engineering of a CorvusSKK user. Patching to 3.3.4 is straightforward and carries no documented side effects, making remediation the unambiguous priority over compensating controls.

An attacker crafts a malicious CorvusSKK configuration or Lua script file - potentially disguised as a legitimate input customization, dictionary, or community configuration - and delivers it to a target user via email, file share, or a compromised download source. When the user loads the file through CorvusSKK on their Windows system, the embedded Lua interpreter executes the injected code in the security context of the logged-in user, granting full control over confidentiality, integrity, and availability of that session. No public proof-of-concept code has been identified at the time of analysis.