CVE-2026-97381

Deferred Deferred - Pending Action

Origin Validation Error in Legacy Update ActiveX Control

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: GitHub, Inc.

Description

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97381

Affected Vendors & Products

Vendor	Product	Version / Range
LegacyUpdate	LegacyUpdate	>= 1.12.0, < 1.13.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-393	A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

Attack-Flow Graph

Executive Summary

Legacy Update 1.12.0 through 1.13.1 has an origin validation error in its ActiveX control's IsPermitted method. When a user visits a malicious webpage in Internet Explorer, the control can be invoked to read the document's hostname. If the hostname is not on the permitted list, the method incorrectly returns S_OK instead of setting E_ACCESSDENIED, allowing unauthorized actions.

Detection Guidance

This vulnerability can be detected by checking the installed version of Legacy Update. If the version is between 1.12.0 and 1.13.1, the system is vulnerable. No specific commands are provided in the context.

Impact Analysis

An attacker could trick you into visiting a malicious webpage to exploit this flaw. This could lead to enumeration of your system and update information, installation of updates without your consent, display of unwanted dialogs, or even an unexpected system restart if a reboot is pending.

Mitigation Strategies

Update Legacy Update to version 1.13.2 or later to address the vulnerability. Remove or disable the ActiveX control if it is not required.

Hi! I’m here to help you understand CVE-2026-97381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70