CorvusSKK EUVD-2026-66245

Exploitation requires CorvusSKK (any version prior to 3.3.4) to be installed on Windows 10 (build 14393 or later) or Windows 11. The critical limiting condition is active user interaction: the victim must open, import, or otherwise process an attacker-supplied tar-format dictionary file within CorvusSKK (CVSS UI:R). No elevated system privileges or special configuration are required for the overflow to trigger (CVSS PR:N), but the attack is confined to the local attack vector (AV:L) - exploitation cannot occur over the network without first delivering the malicious file to the target. There is no evidence that default-installed CorvusSKK auto-loads dictionary files from remote sources, further constraining opportunistic exploitation.

The CVSS 3.0 base score of 4.4 (Medium) is consistent with the constrained attack surface: AV:L requires the attack occur locally or via a file the user processes, AC:L indicates low complexity once the malicious file is in hand, PR:N signals no system privileges are needed, but UI:R is the key limiting factor - a user must actively open a malicious dictionary file. Impact is bounded to low integrity and low availability, with no confidentiality exposure. EPSS data is absent from the available intelligence, preventing quantitative exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, so real-world exploitation opportunity appears low. The combination of local-only vector, mandatory user interaction, and narrow product footprint (niche Japanese IME) makes this a low operational priority for most organizations unless they specifically distribute or receive dictionary files from untrusted external sources.

An attacker crafts a tar-format dictionary file with a specially engineered file size field designed to overflow a signed 32-bit integer when parsed by CorvusSKK. The attacker distributes this file through a Japanese IME community forum, dictionary sharing site, or via direct delivery to a targeted user. When the victim loads the malicious file into CorvusSKK, the integer overflow causes incorrect size calculations and malicious data is written into the local dictionary file.