Executive Summary

This vulnerability exists in the pinget backend of Devolutions UniGetUI version 2026.2.0 and earlier. It involves the use of an incorrectly resolved name or reference, which allows a WinGet community catalog contributor to manipulate the system. Specifically, an attacker can cause an installed application to be mistakenly linked to an unrelated, attacker-controlled catalog package. When a user applies a proposed update, this crafted catalog package can execute an attacker-controlled installer because the normalized name of the malicious package is contained as a substring within the installed application's name.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker can execute arbitrary code on the affected system without requiring user interaction or privileges. This is achieved by tricking the system into running an attacker-controlled installer during an update process. Although the confidentiality and integrity of the system are not directly affected, the availability can be severely impacted due to potential malicious actions performed by the attacker-controlled installer.

Useful 0 Not Useful 0