CVE-2026-120422

Name of the Vulnerable Software and Affected Versions Sogou Input Method for Windows versions prior to 16.10

Description The SGTool.exe component contains a flaw in its configuration retrieval mechanism. The application retrieves configuration data over unencrypted HTTP connections, which allows an attacker who can manipulate network traffic to replace legitimate server responses with malicious configurations. This can be used to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components, leading to arbitrary code execution when those files are executed or loaded. The issue involves the use of the Duplex Message Transport Protocol (DMTP), a communication protocol used for command and control, and supports modular plugins for data theft and persistence.

Recommendations Update to version 16.10 or later to enforce HTTPS across update endpoints.