Skip to content
OpenAdvisories
High WID-SEC-2026-3004 5 CVEs

Wibu-Systems CodeMeter Runtime: Mehrere Schwachstellen

Published Aug 25, 2026 · Updated Aug 26, 2026 · Revision 2 · de-DE

Vendor: Wibu Product: CodeMeter Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Wibu-Systems CodeMeter Runtime ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Berechtigungen zu erweitern und Administratorrechte zu erlangen oder Denial-of-Service-Zustände herbeizuführen.

Product

CodeMeter ist eine Software zur Durchsetzung von Lizenzrechten.

Vulnerabilities 5

  • High 8.6
    CVE-2026-81573

    Improper Access Control in Local-Only Configuration Commands

    If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers.…

    Wibu codemeter-runtime
  • High 8.2
    CVE-2026-81574

    Format String Vulnerability in Logger

    In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information su…

    Wibu codemeter-runtime
  • High 7.8
    CVE-2026-81572

    Local Privilege Escalation in CodeMeter Runtime on Windows

    In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such…

    Wibu codemeter-runtime
  • High 7.7
    CVE-2026-81576

    Improper Authentication of Session Handles

    If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read …

    Wibu codemeter-runtime
  • High 7.5
    CVE-2026-81575

    Missing Sanity Checks for Buffer Lengths

    If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segme…

    Wibu codemeter-runtime

Revision history

  1. #2

    CVE-Nummern ergänzt

  2. #1

    Initiale Fassung

References