Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109556EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC

High 8.0

In plain English

A high-severity security flaw in EdgeEver from tianma-if. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.7%top 48.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

Affected products (as reported)

Vendor	Product	Versions
tianma-if	EdgeEver	1.92.0 – through 1.112.0

Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

GitHub Issue #532 issue-tracking
GitHub Issue #546 issue-tracking
Patch Commit patch
Vulnerable code in acp-host.mjs technical-description
https://github.com/tianma-if/edgeever product
VulnCheck Advisory: EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC third-party-advisory