Codemeter Runtime
Monthly
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode.
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis.
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode.
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. A detailed public research writeup is available from shelltrail.com, substantially lowering the exploitation barrier; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode.
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis.
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode.
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. A detailed public research writeup is available from shelltrail.com, substantially lowering the exploitation barrier; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, which allows local users to gain privileges via a Trojan horse file. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.