Legacy Update CVE-2026-97381

Requires the victim to open an attacker-controlled web page in Internet Explorer on a host where the Legacy Update ActiveX control (versions 1.12.0 through 1.13.1) is registered; the origin-validation flaw then lets any non-permitted hostname pass IsPermitted and call the control's methods. Limiting factors that reduce realistic risk: the attack only works through Internet Explorer (not modern browsers), it requires user interaction (visiting the malicious page), it is confined to the specific vulnerable version range, and the A:H reboot action only occurs when a system reboot is already pending.

The input CVSS base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) frames this as critical, and the GitHub Security Advisory (GHSA-f4g7-4gmx-jfgf) plus the fix commit adding 'hr = E_ACCESSDENIED' confirm the root cause is a genuine origin-validation bypass (CWE-346) in the IsPermitted method. However, the raw score overstates real-world urgency and contains internal inconsistencies that should be noted explicitly: the vector lists UI:N, yet the description requires an attacker to induce a user to visit a malicious webpage - that is user interaction, so UI:N conflicts with the described attack and UI:R is more accurate (verify intended UI). The vector also lists PR:L, but the vulnerability is an unauthenticated origin-check bypass invoked from any web page, implying PR:N rather than PR:L. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no public exploit was supplied - only a fix diff, which is not a weaponized POC. Critically, exploitation is gated on the victim using Internet Explorer with the vulnerable Legacy Update ActiveX control registered, a legacy/niche deployment context. Net assessment: a legitimately high-severity logic flaw, but realistic risk is moderated by the IE/ActiveX precondition, required user interaction, and the product's limited footprint - treat as a priority patch for affected installs rather than a broadly wormable internet-scale threat.

An attacker hosts a malicious web page and lures a victim who runs Legacy Update 1.12.0-1.13.1 into opening it in Internet Explorer. Because IsPermitted returns S_OK for any hostname not on the permitted list, the page's script can invoke the ActiveX control to enumerate system and update information, silently install updates without consent, pop dialogs, or force a reboot when one is pending. No public exploit was identified at time of analysis, though the one-line nature of the fix makes the flaw trivial to reproduce.