{"id":"CVE-2026-97381","published":"2026-10-13T22:19:45.427","lastModified":"2026-10-17T02:19:04.007","description":"Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-346","CWE-393"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033","tags":[]},{"url":"https://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fd","tags":[]},{"url":"https://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0","tags":[]},{"url":"https://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgf","tags":[]},{"url":"https://legacyupdate.net/news/2026/07/21/legacy-update-1-13-2","tags":[]}],"exploitRefs":[{"url":"https://github.com/LegacyUpdate/LegacyUpdate/commit/7d62f0bfaa770d74cd6e2cb0bac9c1907df48033","tags":[]},{"url":"https://github.com/LegacyUpdate/LegacyUpdate/commit/ae1c46c97f39a55a1937784d9f9beb30aa9147fd","tags":[]},{"url":"https://github.com/LegacyUpdate/LegacyUpdate/releases/tag/v1.13.2.0","tags":[]},{"url":"https://github.com/LegacyUpdate/LegacyUpdate/security/advisories/GHSA-f4g7-4gmx-jfgf","tags":[]}],"hasPoc":true,"ai":{"summary":"A flaw in Legacy Update's ActiveX control allows attackers to bypass hostname validation, enabling unauthorized system updates and information enumeration when users visit malicious webpages in Internet Explorer. This represents a critical risk because it can lead to full system compromise through unauthorized updates and privilege escalation.","exploitability":"Exploitation requires user interaction with a malicious webpage in Internet Explorer, making it moderately difficult but achievable through social engineering, with no additional preconditions beyond the vulnerable version being installed.","blast_radius":"The impact could be severe across legacy Windows systems that still use Internet Explorer, potentially allowing attackers to install malicious updates, display unauthorized dialogs, and trigger system restarts without user consent.","remediation":"Upgrade to Legacy Update 1.13.2 or later to remediate the origin validation error in the ActiveX control.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["activex","update","privilege-escalation","legacy"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:46:23.878Z"}}