CVE-2026-64816

{"id": "CVE-2026-64816", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64816", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T11:10:19.362339Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/CyberTimon/RapidRAW", "vendor": "CyberTimon", "product": "RapidRAW", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.0", "versionType": "semver"}], "packageURL": "pkg:github/CyberTimon/RapidRAW", "defaultStatus": "affected"}]}], "published": "2026-07-30T22:16:55.920", "references": [{"url": "https://github.com/CyberTimon/RapidRAW/commit/83852f36ba4a260be", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/CyberTimon/RapidRAW/releases/tag/v1.6.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rapidraw-ntlmv2-credential-leak-via-unc-path-in-lutpath", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels."}, {"lang": "es", "value": "RapidRAW anterior a la versi\u00f3n 1.6.0 no valida el campo lutPath en los archivos de preajustes antes de pasarlo a File::open() en lut_processing.rs. En Windows, una ruta UNC en lutPath provoca una conexi\u00f3n SMB saliente a un host controlado por el atacante, filtrando las credenciales NTLMv2 de la v\u00edctima. La ruta de c\u00f3digo vulnerable es accesible a trav\u00e9s de dos vectores: preajustes de la comunidad obtenidos autom\u00e1ticamente del repositorio remoto de preajustes cuando la v\u00edctima abre la pesta\u00f1a Comunidad, y archivos de preajustes individuales importados directamente por la v\u00edctima a trav\u00e9s de la funci\u00f3n de importaci\u00f3n de preajustes (handle_import_presets_from_file en file_management.rs). El segundo vector no requiere control sobre el repositorio de preajustes de la comunidad y se activa cuando un usuario importa un archivo de preajustes compartido a trav\u00e9s de Discord, foros o canales similares."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "disclosure@vulncheck.com"}