Corvusskk
Monthly
Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though CISA's SSVC framework rates the technical impact as total, reflecting full compromise of confidentiality, integrity, and availability on affected hosts.
CorvusSKK, a Windows-based SKK Japanese input method editor by Sasaki Nobuyuki, contains a signed 32-bit integer overflow (CWE-190) in its tar-format dictionary file size parsing, which can allow malicious data to be written to a dictionary file when a user opens a crafted input. All versions prior to 3.3.4 are affected; version 3.3.4 was released to address this flaw alongside a separate Lua-related vulnerability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation.
Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though CISA's SSVC framework rates the technical impact as total, reflecting full compromise of confidentiality, integrity, and availability on affected hosts.
CorvusSKK, a Windows-based SKK Japanese input method editor by Sasaki Nobuyuki, contains a signed 32-bit integer overflow (CWE-190) in its tar-format dictionary file size parsing, which can allow malicious data to be written to a dictionary file when a user opens a crafted input. All versions prior to 3.3.4 are affected; version 3.3.4 was released to address this flaw alongside a separate Lua-related vulnerability. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation.