CVE-2026-44406

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: May 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-444077.5A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial CVE-2026-444086.3There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attack CVE-2026-444097.5There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers CVE-2026-44418.8Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2026-444103.8This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, CVE-2026-444117.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uniniti CVE-2026-444127.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based o CVE-2026-444137.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access CVE-2026-444146.8A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device CVE-2026-444159.1Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remot CVE-2026-444169.8Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended CVE-2026-444177.5The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code