CVE-2026-109556: EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC

Q: What access does an attacker need to exploit this issue?

An attacker needs the ability to execute script in an EdgeEver Desktop renderer. The described paths include stored cross-site scripting in template-preview or drag-preview.

Q: What privileges would launched code have?

The caller-supplied local executable is launched with the privileges of the current EdgeEver Desktop user. This can result in code execution in that user's security context.

Q: Which installations are affected?

EdgeEver Desktop versions 1.92.0 through 1.112.0 are identified as affected. The issue is in the desktop:acp-probe IPC handler.

Published Oct 12, 2026

Updated

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

Affected Software

1 affected component

EdgeEver Desktop>=1.92.0<=1.112.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs the ability to execute script in an EdgeEver Desktop renderer. The described paths include stored cross-site scripting in template-preview or drag-preview.

What privileges would launched code have?

The caller-supplied local executable is launched with the privileges of the current EdgeEver Desktop user. This can result in code execution in that user's security context.

Which installations are affected?

EdgeEver Desktop versions 1.92.0 through 1.112.0 are identified as affected. The issue is in the desktop:acp-probe IPC handler.

CVE-2026-109556: EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What privileges would launched code have?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What privileges would launched code have?

Which installations are affected?