CVE-2026-51990: Sogou Input Method RCE Vulnerability

CVE-2026-51990 Overview

CVE-2026-51990 is a remote code execution vulnerability in Sogou Input Method versions prior to 16.3.0.3498. The flaw resides in the biz_helper.exe component and allows a remote attacker to execute arbitrary code on affected Windows systems. Sogou Input Method is one of the most widely deployed Chinese-language input method editors (IMEs), which places a large user population at risk. The vendor addressed the issue in version 16.3.0.3498. Public research on this issue is documented in the GenDigital Blog Insights writeup describing a one-click backdoor scenario.

Critical Impact

A remote attacker can execute arbitrary code on systems running vulnerable Sogou Input Method builds by targeting the biz_helper.exe component.

Affected Products

• Sogou Input Method versions prior to 16.3.0.3498
• The biz_helper.exe helper component shipped with Sogou Input Method
• Windows endpoints where the vulnerable IME is installed

Discovery Timeline

• 2026-09-16 - CVE-2026-51990 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-51990

Vulnerability Analysis

The vulnerability affects biz_helper.exe, an auxiliary process bundled with Sogou Input Method. According to the referenced research, the flaw enables remote code execution and has been characterized as a one-click backdoor. An attacker able to reach the vulnerable code path through the helper component can run arbitrary instructions in the security context of the affected process. Because IMEs load early in the user session and interact with a broad set of applications, exploitation provides access to input streams, active windows, and user-owned resources. Full technical details are documented in the GenDigital Blog Insights research publication.

Root Cause

The NVD entry attributes the issue to the biz_helper.exe component of Sogou Input Method builds earlier than 16.3.0.3498. Specific weakness classification (CWE) was not published with the advisory. The fixed build 16.3.0.3498 removes the vulnerable behavior.

Attack Vector

The advisory describes the attack as remote and references a one-click interaction pattern. A victim running a vulnerable Sogou Input Method installation can be induced to trigger the vulnerable helper path, at which point the attacker gains arbitrary code execution. Refer to the GenDigital Blog Insights writeup for the exploitation walkthrough.

No verified proof-of-concept code is published in the enriched CVE data. The vulnerability mechanism is described in prose only; see the referenced research for technical details.

Detection Methods for CVE-2026-51990

Indicators of Compromise

• Unexpected child processes spawned by biz_helper.exe, particularly script hosts, shells, or LOLBins.
• Outbound network connections originating from biz_helper.exe to untrusted or newly registered domains.
• Persistence artifacts such as scheduled tasks or Run keys created shortly after Sogou IME activity.

Detection Strategies

• Inventory endpoints for Sogou Input Method installations and flag any version older than 16.3.0.3498.
• Monitor process ancestry and command-line arguments for biz_helper.exe to identify anomalous invocations.
• Alert on file writes into user-writable directories performed by the Sogou IME process tree.

Monitoring Recommendations

• Enable process creation logging (Windows Event ID 4688 or Sysmon Event ID 1) with command-line capture across managed endpoints.
• Capture network telemetry from IME-related processes and baseline expected destinations for the Sogou update and telemetry infrastructure.
• Retain endpoint telemetry long enough to support retrospective hunts once additional indicators become available.

How to Mitigate CVE-2026-51990

Immediate Actions Required

• Upgrade Sogou Input Method to version 16.3.0.3498 or later on all affected endpoints.
• Identify installations through software inventory and prioritize systems handling sensitive data or administrative accounts.
• Restrict or remove the IME on systems where it is not required for business operations.

Patch Information

Sogou fixed the issue in Sogou Input Method 16.3.0.3498. Users and administrators should obtain the current release from the Sogou Homepage and validate the installed build after deployment. Additional context on the remediation is available in the GenDigital Blog Insights research publication.

Workarounds

• Uninstall Sogou Input Method on endpoints where an alternative IME is acceptable until patching completes.
• Block execution of biz_helper.exe through application control policies on high-value systems pending remediation.
• Restrict outbound network access from the Sogou IME process tree to known-good destinations only.

# Example: query installed Sogou Input Method version on Windows via PowerShell
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
    Where-Object { $_.DisplayName -like '*Sogou*Input*' } |
    Select-Object DisplayName, DisplayVersion, InstallLocation