CVE-2026-36433

Deferred Deferred - Pending Action

Arbitrary Code Execution in Actions Media Player Utilities

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: MITRE

Description

An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code via the Production.dll and RdiskUpgrade.exe components

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-36433

EUVD

EUVD-2026-75164

Affected Vendors & Products

Vendor	Product	Version / Range
actions_semiconductor_co_ltd	media_player_utilities	4.46

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is in Actions Semiconductor Co. Ltd Tool-Media Player Utilities version 4.46. It allows an attacker who has physical access to the device to execute arbitrary code through the Production.dll and RdiskUpgrade.exe components.

Detection Guidance

This vulnerability requires physical access to the device via USB and cannot be detected remotely. Check for unauthorized firmware updates or unusual device behavior after USB connections. Inspect Production.dll and RdiskUpgrade.exe for missing cryptographic validation or unexpected modifications.

Impact Analysis

An attacker with physical proximity could exploit this to run malicious code on your device, potentially leading to unauthorized access, data theft, or system compromise.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves arbitrary code execution via physical proximity, but no details are given about data exposure, privacy risks, or regulatory implications.

Mitigation Strategies

Update or remove the affected components Production.dll and RdiskUpgrade.exe in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46. Restrict physical access to systems running this software to prevent unauthorized exploitation.

Hi! I’m here to help you understand CVE-2026-36433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70