EUVD-2026-66981
GHSA-7c2r-g494-h73x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Remote exploitation requires chaining CVE-2026-81573 as a prerequisite, raising AC to H; standalone local path is AV:L/PR:L, but the network vector is the more impactful scenario to score.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.
AnalysisAI
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Local exploitation requires the ability to execute the `cmu` command-line utility with the `--set-proxy` argument on the host running CodeMeter Runtime - this implies at minimum an authenticated local user session on the target system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) reflects a remote unauthenticated attack scenario, but this rating conflates the chained two-CVE path with a single-CVE rating - standalone exploitation of CVE-2026-81574 alone is described only as a local attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with access to the cmu utility executes `cmu --set-proxy '%x.%x.%x.%s'`, causing the CodeMeter logger to interpret the format specifiers, leaking stack memory contents including canary values that can be used to defeat stack-smashing protections in subsequent exploitation. In the chained remote scenario, an attacker first exploits CVE-2026-81573 to remotely write a malicious format string to General.ProxyServer, then triggers CodeMeter logging activity to achieve memory disclosure or a reliable process crash without any local access. … |
| Remediation | Upgrade CodeMeter Runtime to version 8.41a or later on the 8.x branch, or to version 9.10 or later on the 9.x branch, per the Wibu-Systems advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all systems running CodeMeter Runtime prior to versions 8.41a or 9.10, document criticality, and restrict cmu CLI access to administrative accounts only using OS-level permission controls (filesystem ACLs, SELinux/AppArmor). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codemeter Runtime
View allA heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthentic
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed dat
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file withou
Same weakness CWE-134 – Use of Externally-Controlled Format String
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today