CVE-2026-79079

Summary

A local attacker can execute arbitrary code in CrossWire Xiphos <= 4.3.2 by exploiting vulnerabilities in the src/main/url.cc and src/gtk/menu_popup.c components, allowing for full control over the application.

Exploitability

Exploitation requires local access and knowledge of the specific vulnerabilities, making it moderately difficult.

Blast radius

If exploited, the attacker could gain full control over the affected system, leading to potential data loss or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to CrossWire Xiphos 4.3.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.