CVE-2026-109556

HighCVSS 8.0

Published: 12/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

42th percentile - higher than 42% of all known CVEs

Summary

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

Risk Assessment

The risk includes full remote code execution with user privileges, potentially leading to system compromise or malware installation.

Recommendation

It is recommended to update to a version newer than 1.112.0 immediately and add sender verification in the IPC handler to prevent unauthorized calls.

Other vulnerabilities in EdgeEver Desktop

CVE-2026-109559High
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS