EUVD-2026-66244Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with required user interaction and no privilege requirement; unchanged scope as impact is confined to the CorvusSKK process and the authenticated user session.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.
AnalysisAI
Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to be running CorvusSKK prior to version 3.3.4 on Windows 10 (build 14393 or later) or Windows 11. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 carries meaningful attenuation signals: AV:L (local attack vector) and UI:A (active user interaction required) together rule out remote unauthenticated or automated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious CorvusSKK configuration or Lua script file - potentially disguised as a legitimate input customization, dictionary, or community configuration - and delivers it to a target user via email, file share, or a compromised download source. When the user loads the file through CorvusSKK on their Windows system, the embedded Lua interpreter executes the injected code in the security context of the logged-in user, granting full control over confidentiality, integrity, and availability of that session. … |
| Remediation | The primary and recommended fix is to upgrade CorvusSKK to version 3.3.4, available at https://github.com/nathancorvussolis/corvusskk/releases/tag/3.3.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running CorvusSKK and document their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today