CVE-2026-11980

HighCVSS 7.3/10Last modified Oct 23, 2026

Description

IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-242

Affected software

VendorProductVersions
IBMAspera Desktop App>= 1.0.5, <= 1.0.19

References

Timeline

Published
Jul 30, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1198004.3Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contentCVE-2026-119814.3The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing CVE-2026-1198167.8Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.CVE-2026-1198177.8Double free in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-1198187.8Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.CVE-2026-119825.1Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.CVE-2026-1198217.8Improper authorization in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.CVE-2026-1198227.0Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevatCVE-2026-1198236.8Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to execute code with a physical attack.CVE-2026-1198248.8Missing authentication for critical function in Remote Desktop Client allows an unauthorized attacker to perform tampering over a network.CVE-2026-1198255.5Use of uninitialized resource in Windows Win32K allows an authorized attacker to disclose information locally.CVE-2026-1198267.8Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-11980: High severity, CVSS 7.3 | Vulnix