CVE-2026-41450: uac 0 to before 3.3.0

Affected technology

uac · 0 to before 3.3.0
tclahr

Description’s affected range: versions prior to 3.3.0

Component: Not specified by the source
Function: where

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality, integrity and availability impact as high.