Kdenlive EUVD-2026-28946

The exploit requires that a user explicitly open an attacker-controlled Kdenlive project file (.kdenlive) in Kdenlive before version 26.04.1. The application must parse the malicious proxy parameters from the project XML without user confirmation or sanitization. Exploitation is limited to the privileges of the user running Kdenlive and does not require prior authentication to the application; however, the user must have access to the attacker's malicious file (either through social engineering, file sharing, or compromise of a file repository). This is NOT a default remote code execution; it requires deliberate user action to open the file, placing it in the 'AC:H' (High Complexity) category despite the local attack vector.

CVSS score of 6.5 (Medium) with local attack vector and high complexity reflects the requirement for user interaction and local system access, yet the confidentiality and integrity impacts are rated High. EPSS data was not provided. The actual exploitation risk is moderately elevated because the attack requires social engineering (tricking a user to open a malicious project file), but once the file is opened, code execution is likely. The local attack vector (AV:L) and requirement for user interaction (UI:R) significantly constrain real-world exploitability compared to a network-based vulnerability. However, video editors are common tools in creative workflows, and .kdenlive files may be shared collaboratively, increasing the likelihood of accidental exposure. The lack of confirmed active exploitation (KEV status not provided) suggests this may be a responsibly disclosed vulnerability patched before weaponization, reducing immediate urgency but not eliminating the need for timely patching, especially in environments where project file sharing occurs.

An attacker creates a malicious Kdenlive project file (.kdenlive, which is XML) with crafted proxy parameters designed to execute arbitrary shell commands. The attacker distributes this file as a legitimate video project via email, file-sharing platforms, or by compromising a creative collaboration workspace. When a victim opens the project in Kdenlive (satisfying the UI:R requirement), the application parses the proxy settings and executes the embedded commands with the user's privileges, allowing data exfiltration, malware installation, or lateral movement within the user's system.