CVE-2026-3502

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3502
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://trueconf.com/blog/update/trueconf-8-5 Product Release Notes
https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502 US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:trueconf:trueconf:*:*:*:*:*:windows:*:*
History

03 Apr 2026, 11:40

Type Values Removed Values Added
CPE cpe:2.3:a:trueconf:trueconf:*:*:*:*:*:windows:*:*
First Time Trueconf
Trueconf trueconf
References () https://trueconf.com/blog/update/trueconf-8-5 - () https://trueconf.com/blog/update/trueconf-8-5 - Product, Release Notes
References () https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/ - () https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/ - Third Party Advisory
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502 - US Government Resource

02 Apr 2026, 18:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502 -

31 Mar 2026, 19:16

Type Values Removed Values Added
Summary
  • (es) TrueConf Client descarga código de actualización de la aplicación y lo aplica sin realizar verificación. Un atacante que es capaz de influir en la ruta de entrega de la actualización puede sustituir una carga útil de actualización manipulada. Si la carga útil es ejecutada o instalada por el actualizador, esto puede resultar en ejecución de código arbitrario en el contexto del proceso de actualización o del usuario.
References
  • () https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/ -

30 Mar 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-30 19:16

Updated : 2026-04-03 11:40

NVD link : CVE-2026-3502

Mitre link : CVE-2026-3502

CVE.ORG link : CVE-2026-3502

JSON object : View

Products Affected

trueconf

  • trueconf
CWE
CWE-494

Download of Code Without Integrity Check