Liman Render Engine CVE-2026-77703

Exploitation requires the attacker to first establish an Adversary-in-the-Middle position on the network path between the victim client and the Liman Render Engine (versions 1.0 up to but excluding 1.2-75), since the flaw is a key exchange performed without entity authentication (CWE-322). No credentials are needed (PR:N) and no user interaction is required (UI:N), but the on-path requirement is the primary limiting factor and is reflected in the HIGH attack complexity (AC:H) - the attacker must control or intercept the network segment (e.g., ARP spoofing, rogue access point, compromised router). The impact is limited to confidentiality of intercepted traffic; there is no claimed integrity or availability impact.

This is a moderate, situational risk rather than a broad-exploitation priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) reflects a network-reachable, unauthenticated flaw but with HIGH attack complexity - consistent with a CWE-322 key-exchange-without-entity-authentication weakness that requires the attacker to already occupy an Adversary-in-the-Middle (AiTM) position on the network path. All exploitation signals point to low current urgency: SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing, no EPSS score provided, and no public exploit code identified. Impact is confidentiality-only (C:H, I:N, A:N) - an on-path attacker can intercept/decrypt traffic but the CVE does not claim tampering or availability effects. Note a data-quality conflict: the input Tags include 'Microsoft', which is inconsistent with the affected product being HAVELSAN Inc.'s Liman Render Engine (a Turkish vendor with no Microsoft relationship); treat the Microsoft association as erroneous. Overall: a real but AiTM-gated confidentiality issue that matters most where network paths are untrusted, not a mass-exploitable priority.

An attacker who can position themselves on the network path between a client and the Liman Render Engine (e.g., via ARP spoofing, rogue Wi-Fi/router, or compromised upstream network segment) exploits the unauthenticated key exchange to establish a session without verifying the server's identity, then decrypts or relays traffic. Because entity authentication is missing during key exchange, the AiTM attacker can silently read sensitive data in transit. No public exploit code is currently identified, and success depends on first achieving the on-path position (high attack complexity).