High · 7.8 CVE-2026-79079 EUVD-2026-84185GHSA-m3hm-f9qq-cmg5

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c co…

Published Sep 21, 2026 · Updated Sep 22, 2026 · Assigned by mitre

Package: xiphos Package: xiphos Ecosystem: Debian Ecosystem: Ubuntu

Description

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	xiphos	4.4.0+dfsg1-1	—
Debian 13	xiphos	No fix yet	—
Debian 12	xiphos	No fix yet	—

Ubuntu