Andrew Teylu

**Name of the Vulnerable Software and Affected Versions** CodeMeter Runtime versions prior to 8.41a CodeMeter Runtime versions prior to 9.10 **Description** When configured as a server, the configuration command handler fails to enforce network-origin restrictions. This allows remote peers to execute commands that should be restricted to local or same-network clients. An attacker can read sensitive configuration data and modify values within the `Server.ini` file, including the credential hash for the CodeMeter WebAdmin, which can lead to a full takeover of the WebAdmin interface. **Recommendations** Update CodeMeter Runtime to version 8.41a or later. Update CodeMeter Runtime to version 9.10 or later.

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeMeter Runtime versions prior to 8.41a CodeMeter Runtime versions prior to 9.10 **Description** When configured as a server, the software accepts requests using opcode 0x5e that include a data length value and the associated data. A lack of bounds checking on the data length value allows for out-of-bounds reads, which can trigger a segmentation fault—a memory access violation—resulting in a crash of the CodeMeter Runtime. **Recommendations** Update CodeMeter Runtime to version 8.41a or later. Update CodeMeter Runtime to version 9.10 or later.

**Name of the Vulnerable Software and Affected Versions** CodeMeter Runtime versions prior to 8.41a CodeMeter Runtime versions prior to 9.10 **Description** When configured as a server, the software issues handles per connection and uses a cryptographically weak SID (Session Identifier) as the only method of authentication. This allows an attacker to brute-force the `SID`, recover the handle number of another session, and read license information associated with that handle. **Recommendations** Update CodeMeter Runtime to version 8.41a or later. Update CodeMeter Runtime to version 9.10 or later.