{"id":"CVE-2026-79079","aliases":["DEBIAN-CVE-2026-79079","EUVD-2026-84185","GHSA-m3hm-f9qq-cmg5","UBUNTU-CVE-2026-79079"],"status":"published","title":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the...","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00191,"percentile":0.08884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-09-21T00:00:00Z","modified":"2026-09-24T02:00:52Z","fixes":[{"ecosystem":"Debian:14","package":"xiphos","fixed_in":["4.4.0+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+dfsg1-7","4.2.1+dfsg1-8","4.3.2+dfsg1-1","4.3.2+dfsg1-2","4.4.0+dfsg1-1","4.5.0+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.2+dfsg1-1","4.3.2+dfsg1-2","4.4.0+dfsg1-1","4.5.0+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0+dfsg1-1"}]}],"versions":["4.3.2+dfsg1-1","4.3.2+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0+dfsg1-0ubuntu2","4.0.4+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.4+dfsg1-1","4.0.7+dfsg1-1","4.0.7+dfsg1-1build1","4.0.7+dfsg1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+dfsg1-5","4.2.1+dfsg1-6","4.2.1+dfsg1-6build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1+dfsg1-7build1","4.2.1+dfsg1-7build2","4.2.1+dfsg1-8","4.2.1+dfsg1-8build2","4.2.1+dfsg1-8build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xiphos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.2+dfsg1-1build1","4.3.2+dfsg1-1build2","4.3.2+dfsg1-2"]}],"references":[{"url":"https://github.com/crosswire/xiphos/pull/1314/commits/68bbe3063b601537d1e505dd1a4560d51811a9e0","tags":["report"]},{"url":"https://gist.github.com/lggcs/c1f98ce55ced44472651b9590d9f199a","tags":["exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79079"},{"url":"https://github.com/advisories/GHSA-m3hm-f9qq-cmg5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79079","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-79079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79079","tags":["report"]},{"url":"https://github.com/crosswire/xiphos/pull/1314","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-79079","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T13:49:26.465Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:50:27.582139Z"}],"euvd":[{"id":"EUVD-2026-84185","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-09-22T13:49:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:03.363938Z"}],"ghsa":[{"id":"GHSA-m3hm-f9qq-cmg5","title":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the...","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","status":"published","published":"2026-09-22T00:30:54Z","modified":"2026-09-22T15:33:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:12:17.909941Z"}],"nvd":[{"id":"CVE-2026-79079","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","status":"published","published":"2026-09-21T22:16:59Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"DEBIAN-CVE-2026-79079","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","status":"published","published":"2026-09-21T22:16:59Z","modified":"2026-09-23T09:00:11.106715452Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"UBUNTU-CVE-2026-79079","description":"An issue in CrossWire Xiphos \u003c= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components","status":"published","published":"2026-09-21T22:16:00Z","modified":"2026-09-24T02:00:52.854360256Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:18.015985Z"}]}}