CVE-2026-119250

HighCVSS 7.8/10Last modified Oct 31, 2026

Description

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 29, 2026
Last modified
Oct 31, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1192516.7A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for CVE-2026-1192595.3The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing iCVE-2026-119267.5IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resCVE-2026-1192608.8Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1192619.6Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentCVE-2026-1192628.8Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox viaCVE-2026-1192639.6Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sCVE-2026-1192648.8Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sCVE-2026-1192658.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pCVE-2026-1192668.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer pCVE-2026-1192678.8Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a cCVE-2026-1192688.8Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via
CVE-2026-119250: High severity, CVSS 7.8 | Vulnix