PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109556 tianma-if CVE debrief

CVE-2026-109556 EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC: Attackers with script execution in a renderer can call probeAcpAdapter to launch local executables with the user's privileges, potentially leading to lateral movement and unauthorized access. Defenders should assess exposure and prioritize remediation, focusing on verifying and remediating affected versions and monitoring for suspicious activity. The vulnerability exists in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable.

Vendor
tianma-if
Product
EdgeEver
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for EdgeEver Desktop deployments, particularly those with script execution in a renderer, should assess exposure and prioritize remediation. This includes verifying and remediating EdgeEver Desktop versions 1.92.0 through 1.112.0, monitoring for suspicious activity related to EdgeEver Desktop, and reviewing compensating controls for exposed systems. Security teams and vulnerability management teams should also review the official

Why it matters

CVE-2026-109556 allows attackers to execute local programs with user privileges via ACP IPC, impacting EdgeEver Desktop deployments with script execution in a renderer.

  • Launch of local executables with user privileges
  • Potential for lateral movement
  • Need for version verification and remediation

Technical summary

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. This allows attackers with script execution in a renderer to launch local executables with the user's privileges, potentially leading to lateral movement and unauthorized access. The vulnerability can be exploited through ACP IPC, and defenders should prioritize verifying and remediating affected versions to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying and remediating EdgeEver Desktop versions 1.92.0 through 1.112.0 due to a local program execution vulnerability.

Recommended defensive actions

  • Verify EdgeEver Desktop version and assess exposure
  • Remediate vulnerable EdgeEver Desktop versions 1.92.0 through 1.112.0
  • Monitor for suspicious activity related to EdgeEver Desktop
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in EdgeEver Desktop 1.92.0 through 1.112.0, including a description of the issue and affected versions. However, the scope of affected deployments and potential impact on specific environments requires further verification. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. The vulnerability allows attackers to execute local programs with user privileges via ACP IPC, impacting EdgeEver Desktop with a

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109556 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109556

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109556 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109556

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109556.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tianma-if/edgeever/issues/532

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tianma-if/edgeever/issues/546

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/desktop/src/main/acp-host.mjs

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/tianma-if/edgeever

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/edgeever-desktop-1.92.0-through-1.112.0-local-program-execution-via-acp-ipc

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.