CVE-2026-33253

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Metrics

CVSS 4.0 8.4/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-428

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-332547.5An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a CVE-2026-332567.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332577.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332587.5By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.CVE-2026-332595.0Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally CVE-2026-33268.6The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX act CVE-2026-332607.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332615.9A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.CVE-2026-332625.9An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of ser CVE-2026-332634.3When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor ha CVE-2026-332649.8A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / AP CVE-2026-332659.0In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.