CVE-2026-81574

EUVD-2026-66981

27.08.2026, 10:16

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory
and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and
remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this
vulnerability.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
wibu	CNA	8.2 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 33.83%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
wibu	codemeter_runtime	9.0 ≤ 𝑥 < 9.10	CNA
wibu	codemeter_runtime	8.0 ≤ 𝑥 < 8.41a	CNA
wibu	codemeter_runtime	7.0	CNA

Common Weakness Enumeration

CWE-134 - Use of Externally-Controlled Format String
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.

Vulnerability Media Exposure

[GERMAN] Wibu-Systems CodeMeter Runtime: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Wibu-Systems CodeMeter Runtime ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Berechtigungen zu erweitern und Administratorrechte zu erlangen oder Denial-of-Service-Zustände herbeizuführen.
Published: 2026-08-25T22:00:00+00:00

References

https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf