Ipc

Wails v2 allows attackers to bypass BindingsAllowedOrigins restrictions via a permissive regex flaw in origin validation, potentially enabling unauthorized execution of Go backend methods.

An improper access control vulnerability in the TeamViewer installer staging directory allows local low-privileged users to achieve arbitrary code execution as SYSTEM via a crafted installer options file.

Vifm versions 0.8.1-beta through 0.14.4 are vulnerable to local command injection and privilege escalation due to insecure IPC FIFO reuse in shared temporary directories.

NetEase Cloud Music versions 3.1.38 and 3.1.39.205426 are vulnerable to remote code execution due to improper validation of URL schemes in the IPC bridge, allowing arbitrary local binary execution via API response forgery.

Telegram Desktop versions prior to 7.2.9 contain an IPC record-separator injection vulnerability in the Core::Sandbox component, allowing remote attackers to exfiltrate local session data via crafted tg:// links.

This analytic identifies the use of suspicious named pipes on Windows systems, a technique commonly leveraged by malware and post-exploitation frameworks for inter-process communication.

This brief details a detection strategy for identifying the creation or connection to known malicious named pipes used by C2 frameworks like Cobalt Strike and Brute Ratel to facilitate post-exploitation communication.

CVE-2026-21711 allows code running under the Node.js permission model without network access to create and expose local IPC endpoints via Unix Domain Sockets, bypassing intended network restrictions and enabling inter-process communication.

A command injection vulnerability exists in 666ghj MiroFish version 0.1.2 via the SimulationIPCClient.send_command function, allowing remote attackers to execute arbitrary commands.