P4Verified

CVE-2026-41449: uac 0 to before 3.3.0

CVE-2026-41449. CVSS 3.1 base score 7.8 (HIGH, Vendor/CNA). EPSS 0.01033 (percentile 0.6286), scored 13-Oct-2026.

Affected technology

uac · 0 to before 3.3.0
tclahr

Description’s affected range: versions prior to 3.3.0

Component: Not specified by the source
Function: that

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality, integrity and availability impact as high.

Published 15-Oct-2026 01:10 UTC

CWE: CWE-78
CCR priority: 31.5 /100 (P4)
CVSS 3.1: 7.8 /10 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · Vendor/CNA
EPSS: 0.01033 · percentile 0.6286 · 2026-10-13
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-15 01:07:31.726917+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-41449.html