CVE-2026-112049: Vita3K 0 to before 4187

Affected technology

Vita3K · 0 to before 4187
Vita3K

Description’s affected range: before build 4187

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Active user interaction

What an attacker can do

Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere writable by Vita3K, potentially enabling host code execution. Vendor/CNA’s CVSS 4.0 assessment (base score 6.7/10) rates confidentiality and availability impact as none; integrity impact as high.