CVE-2026-3502
TrueConf Client Update Integrity Verification Bypass
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- March 03, 2026
- Published Date
- March 30, 2026
- Last Updated
- April 03, 2026
- Vendor
- TrueConf
- Product
- TrueConf Client
- Description
- TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
- Tags
- Exploitation
- active
- Technical Impact
- total
- Exploited in the Wild
- Yes (2026-06-01 12:42:57 UTC) Source
cisa
CVSS Scores
CVSS v3.1
7.8 - HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
SSVC Information
Exploit Status
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CVE | 2026-06-01 12:42:57 UTC |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel