EUVD-2026-66245Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector requires user to open a malicious file; UI:R is mandatory; no privileges needed; impact is limited to dictionary file integrity and availability only.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.
AnalysisAI
CorvusSKK, a Windows-based SKK Japanese input method editor by Sasaki Nobuyuki, contains a signed 32-bit integer overflow (CWE-190) in its tar-format dictionary file size parsing, which can allow malicious data to be written to a dictionary file when a user opens a crafted input. All versions prior to 3.3.4 are affected; version 3.3.4 was released to address this flaw alongside a separate Lua-related vulnerability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires CorvusSKK (any version prior to 3.3.4) to be installed on Windows 10 (build 14393 or later) or Windows 11. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 4.4 (Medium) is consistent with the constrained attack surface: AV:L requires the attack occur locally or via a file the user processes, AC:L indicates low complexity once the malicious file is in hand, PR:N signals no system privileges are needed, but UI:R is the key limiting factor - a user must actively open a malicious dictionary file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a tar-format dictionary file with a specially engineered file size field designed to overflow a signed 32-bit integer when parsed by CorvusSKK. The attacker distributes this file through a Japanese IME community forum, dictionary sharing site, or via direct delivery to a targeted user. … |
| Remediation | Vendor-released patch: 3.3.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today