Description

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-27T10:16:40.077Z",
  "pubdate": "2026-08-27T10:16:40.077Z",
  "executiveSummary": "CodeMeter Runtime versions prior to 8.41a and 9.10 contain a format string vulnerability within the logging subsystem. The defect arises from the failure to sanitize user-supplied input before passing it to internal printf-style formatting functions.\nThis vulnerability allows unauthenticated attackers to trigger a process crash (Denial of Service) or perform unauthorized memory disclosure, potentially leaking sensitive process memory and stack canaries.\nThe vulnerability is exploitable locally via command-line arguments (e.g., cmu --set-proxy) or remotely if chained with CVE-2026-81573 to manipulate the General.ProxyServer configuration setting.\nSuccessful exploitation facilitates the bypass of exploit mitigations such as Address Space Layout Randomization (ASLR) by leaking stack canaries, which may be leveraged for further malicious code execution. Organizations are at risk of system instability and information exposure.",
  "technicalDetails": "The root cause of this vulnerability is an improper input validation flaw within the CodeMeter Runtime logging component. Specifically, the application utilizes C-style variadic functions for logging purposes without implementing necessary sanitization or format string control. When processing configuration parameters such as the proxy server address, the software fails to treat input as literal data, allowing user-provided format specifiers (e.g., %x, %p, %s) to be interpreted by the underlying print family of functions.\nIn a local attack scenario, an attacker with local access to the system can invoke the cmu utility to set the proxy value. By injecting crafted printf-style tokens into the proxy argument, the attacker forces the logger to interpret these tokens against the process stack and registers.\nRemote exploitation is achieved by chaining this vulnerability with CVE-2026-81573. By first exploiting the related remote configuration vulnerability to set the General.ProxyServer value, an attacker can trigger the vulnerable logging path remotely. Once the logging function processes the tainted string, it treats subsequent memory addresses as arguments to the format function.\nExploitation occurs through the following steps: 1. Input Injection: The attacker writes malicious format specifiers into the affected configuration field. 2. Processing: The application retrieves the malicious string during a logging operation. 3. Memory Disclosure/Crash: If the format string contains extraction specifiers (e.g., %p), the logger outputs data from the stack or heap to logs or response buffers. If the attacker provides an invalid pointer address within a specifier (e.g., %s directed at an unmapped address), the process encounters a segmentation fault, leading to a crash and Denial of Service.\nThe impact includes the exposure of sensitive memory contents, including stack canaries, which are critical for defeating stack-based buffer overflow protections. The disclosure of these values is a prerequisite for more advanced memory corruption attacks that bypass modern binary hardening protections."
}