CVE-2026-97381

Summary

A flaw in Legacy Update's ActiveX control allows attackers to bypass hostname validation, enabling unauthorized system updates and information enumeration when users visit malicious webpages in Internet Explorer. This represents a critical risk because it can lead to full system compromise through unauthorized updates and privilege escalation.

Exploitability

Exploitation requires user interaction with a malicious webpage in Internet Explorer, making it moderately difficult but achievable through social engineering, with no additional preconditions beyond the vulnerable version being installed.

Blast radius

The impact could be severe across legacy Windows systems that still use Internet Explorer, potentially allowing attackers to install malicious updates, display unauthorized dialogs, and trigger system restarts without user consent.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Legacy Update 1.13.2 or later to remediate the origin validation error in the ActiveX control.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.