CodeMeter Runtime EUVD-2026-66981

Local exploitation requires the ability to execute the cmu command-line utility with the --set-proxy argument on the host running CodeMeter Runtime - this implies at minimum an authenticated local user session on the target system. Remote unauthenticated exploitation requires that CVE-2026-81573 is simultaneously present and unpatched on the same host, as that companion vulnerability provides the mechanism to set the General.ProxyServer configuration value remotely; without CVE-2026-81573, no remote attack path for this CVE is described. The vulnerability is triggered through CodeMeter's logging path when the proxy configuration string is processed, requiring that logging is active (described as the default behavior). Exploitation is limited to CodeMeter Runtime versions prior to 8.41a or 9.10; patched versions are not affected.

The vendor-assigned CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) reflects a remote unauthenticated attack scenario, but this rating conflates the chained two-CVE path with a single-CVE rating - standalone exploitation of CVE-2026-81574 alone is described only as a local attack. The AC:L assignment appears optimistic given that remote exploitation requires CVE-2026-81573 to also be present and unpatched, which is a meaningful prerequisite. The A:H impact is well-supported by the description's claim of reliable crashes. The C:L impact deserves additional weight: disclosed stack canary values can undermine exploit mitigations system-wide, making this more than a simple information leak. No EPSS score or CISA KEV listing was provided, so exploitation probability cannot be quantified; the vulnerability is not confirmed as actively exploited at time of analysis. Organizations running CodeMeter Runtime in networked licensing infrastructure - particularly where multiple Wibu-Systems CVEs are simultaneously unpatched - should treat this as a priority remediation, as the chained remote path requires only that both CVEs coexist rather than any specialized attacker capability.

A local attacker with access to the cmu utility executes cmu --set-proxy '%x.%x.%x.%s', causing the CodeMeter logger to interpret the format specifiers, leaking stack memory contents including canary values that can be used to defeat stack-smashing protections in subsequent exploitation. In the chained remote scenario, an attacker first exploits CVE-2026-81573 to remotely write a malicious format string to General.ProxyServer, then triggers CodeMeter logging activity to achieve memory disclosure or a reliable process crash without any local access. No public proof-of-concept code has been identified at time of analysis.