CVE-2026-19352

{"id": "CVE-2026-19352", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19352", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T15:28:38.908647Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.2, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:mifi:lossless-cut:*:*:*:*:*:*:*:*"], "vendor": "mifi", "modules": ["Built-in HTTP API Service"], "product": "lossless-cut", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}, {"status": "affected", "version": "3.7"}, {"status": "affected", "version": "3.8"}, {"status": "affected", "version": "3.9"}, {"status": "affected", "version": "3.10"}, {"status": "affected", "version": "3.11"}, {"status": "affected", "version": "3.12"}, {"status": "affected", "version": "3.13"}, {"status": "affected", "version": "3.14"}, {"status": "affected", "version": "3.15"}, {"status": "affected", "version": "3.16"}, {"status": "affected", "version": "3.17"}, {"status": "affected", "version": "3.18"}, {"status": "affected", "version": "3.19"}, {"status": "affected", "version": "3.20"}, {"status": "affected", "version": "3.21"}, {"status": "affected", "version": "3.22"}, {"status": "affected", "version": "3.23"}, {"status": "affected", "version": "3.24"}, {"status": "affected", "version": "3.25"}, {"status": "affected", "version": "3.26"}, {"status": "affected", "version": "3.27"}, {"status": "affected", "version": "3.28"}, {"status": "affected", "version": "3.29"}, {"status": "affected", "version": "3.30"}, {"status": "affected", "version": "3.31"}, {"status": "affected", "version": "3.32"}, {"status": "affected", "version": "3.33"}, {"status": "affected", "version": "3.34"}, {"status": "affected", "version": "3.35"}, {"status": "affected", "version": "3.36"}, {"status": "affected", "version": "3.37"}, {"status": "affected", "version": "3.38"}, {"status": "affected", "version": "3.39"}, {"status": "affected", "version": "3.40"}, {"status": "affected", "version": "3.41"}, {"status": "affected", "version": "3.42"}, {"status": "affected", "version": "3.43"}, {"status": "affected", "version": "3.44"}, {"status": "affected", "version": "3.45"}, {"status": "affected", "version": "3.46"}, {"status": "affected", "version": "3.47"}, {"status": "affected", "version": "3.48"}, {"status": "affected", "version": "3.49"}, {"status": "affected", "version": "3.50"}, {"status": "affected", "version": "3.51"}, {"status": "affected", "version": "3.52"}, {"status": "affected", "version": "3.53"}, {"status": "affected", "version": "3.54"}, {"status": "affected", "version": "3.55"}, {"status": "affected", "version": "3.56"}, {"status": "affected", "version": "3.57"}, {"status": "affected", "version": "3.58"}, {"status": "affected", "version": "3.59"}, {"status": "affected", "version": "3.60"}, {"status": "affected", "version": "3.61"}, {"status": "affected", "version": "3.62"}, {"status": "affected", "version": "3.63"}, {"status": "affected", "version": "3.64"}, {"status": "affected", "version": "3.65"}, {"status": "affected", "version": "3.66"}, {"status": "affected", "version": "3.67"}, {"status": "affected", "version": "3.68"}, {"status": "affected", "version": "3.69.0"}]}]}], "published": "2026-08-09T13:16:50.927", "references": [{"url": "https://github.com/mifi/lossless-cut/", "source": "cna@vuldb.com"}, {"url": "https://github.com/mifi/lossless-cut/commit/260802348955231442c4bae6c2d9d8ede947af0a", "source": "cna@vuldb.com"}, {"url": "https://my.feishu.cn/file/Jq4Ib90xeod3oPxlk77cv7jPnFe", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-19352", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/865910", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/387191", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/387191/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: \"I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug.\" The CVSS vector reflects the high level of pre-requisites."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en mifi lossless-cut hasta la versi\u00f3n 3.69.0. Afectada por este problema est\u00e1 alguna funcionalidad desconocida del archivo src/main/httpServer.ts del componente Built-in HTTP API Service. La ejecuci\u00f3n de una manipulaci\u00f3n puede conducir a la falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque requiere acceso a la red local. Este ataque se caracteriza por una alta complejidad. Se sabe que la explotaci\u00f3n es dif\u00edcil. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este parche se llama 260802348955231442c4bae6c2d9d8ede947af0a. Es una buena pr\u00e1ctica aplicar un parche para resolver este problema. El mantenedor del proyecto ofrece esta opini\u00f3n: \u2019No estoy seguro de que esta sea una vulnerabilidad cr\u00edtica, porque est\u00e1 detr\u00e1s de una bandera CLI experimental y el comportamiento de NTLM no es realmente un error de LosslessCut.\u2019 El vector CVSS refleja el alto nivel de prerrequisitos."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "cna@vuldb.com"}