CVE-2026-104809
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
- CVSS 4.0
- 8.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Amber - EPSS
- 0.10% chance of exploitation in the next 30 days; higher than 0% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-73, CWE-426, CWE-427, CWE-494, CWE-829
- Published
- Modified
- Record from
- the NVD, synced