uTox EUVD-2026-104923

Exploitation requires (1) the attacker to be an already-accepted Tox friend/contact of the victim, and (2) the victim to have the auto-accept file-transfer feature enabled, which is a non-default setting - this is precisely the AT:P attack requirement. Given those, the attacker sends a file whose name is an absolute path or contains ../ traversal sequences (the unpatched code in utox.c called native_autoselect_dir_ft without validating the filename). Code execution further depends on the victim's environment: either overwriting a shell startup file that is later sourced, or planting a .ftinfo resume record that ft_find_resumeable() parses, abusing FILE pointers to write /proc/self/mem. Limiting factors: no exploitation against untrusted strangers or default configurations, and the write-to-execute step depends on platform specifics (Linux /proc/self/mem) and victim behavior.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 (High) and is internally consistent with the description: exploitation is network-reachable but gated by two preconditions - the attacker must be an accepted Tox friend (PR:L) and the victim must have the non-default auto-accept feature enabled, which the AT:P (attack-requirement present) metric correctly reflects. These gating factors are the key reason this is not a drive-by, mass-exploitable flaw despite the network vector and the severe VC/VI/VA:H triple impact (arbitrary file write escalating to code execution via the /proc/self/mem technique). No EPSS score was supplied, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; likewise no public POC is referenced, only source-level root-cause pointers and vendor patch PRs. Signals are consistent rather than conflicting - the main caveat is that real-world risk is heavily gated by the auto-accept + trusted-friend requirement, placing this below internet-facing unauthenticated RCEs in priority. Treat as a meaningful priority only for deployments that run uTox with auto-accept enabled; patch availability makes remediation straightforward.

An attacker who is already an accepted Tox contact of a victim running uTox with auto-accept enabled sends a file transfer whose filename contains an absolute path or ../ sequences, causing the file to be written outside the intended download directory. They overwrite a shell startup file, or plant a crafted .ftinfo resume record that ft_find_resumeable() later loads, abusing FILE pointers to write /proc/self/mem and achieve code execution. No public exploit code was identified at time of analysis, though the vendor advisory and source references detail the mechanism.