CVE-2026-97381: Legacy Update ActiveX control accepts unauthorized hosting origins
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting EACCESSDENIED, causing IsPermitted to return SOK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Legacy Update ActiveX controlto a version that resolves this vulnerability.Fixed in 1.13.2
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
Systems running Legacy Update versions 1.12.0 through 1.13.1 are exposed when a user visits an attacker-controlled webpage in Internet Explorer. The attacker does not need to be on an approved hosting origin because the control can incorrectly approve unlisted hostnames.
What does an attacker need to exploit this issue?
An attacker needs to induce a user to visit a malicious webpage in Internet Explorer. The vulnerability does not require user interaction beyond visiting that page, but it requires the vulnerable ActiveX control to be available on the system.
What can the malicious page do through the control?
It can enumerate update and system information, install updates without consent, show dialogs, and restart the computer when a reboot is pending. The listed actions occur in the context of invoking the vulnerable ActiveX control.
What is the available remediation?
Upgrade Legacy Update to version 1.13.2, which fixes the issue. The affected version range ends at 1.13.1.