CVE-2026-76148 Overview
CorvusSKK contains a code injection vulnerability [CWE-94] that can lead to arbitrary code execution on affected systems. CorvusSKK is a Japanese SKK-style Input Method Editor (IME) for Windows. An attacker with local access can leverage improper control of generated code to execute arbitrary commands within the context of the affected process. Exploitation requires user interaction, which limits mass exploitation but does not eliminate risk for targeted attacks on developer or end-user workstations.
Critical Impact
Successful exploitation allows arbitrary code execution with high impact to confidentiality, integrity, and availability of the affected host.
Affected Products
- CorvusSKK versions prior to 3.3.4
- Windows environments running the CorvusSKK IME
- Reference: GitHub Release 3.3.4
Discovery Timeline
- 2026-08-26 - CVE CVE-2026-76148 published to NVD
- 2026-08-26 - Last updated in NVD database
- Coordinated disclosure tracked via JVN Advisory JVN18496672
Technical Details for CVE-2026-76148
Vulnerability Analysis
The flaw is classified as Improper Control of Generation of Code, commonly referred to as Code Injection [CWE-94]. CorvusSKK processes input in a way that permits attacker-controlled data to influence code generation or execution paths. When a user interacts with a crafted input or configuration, the IME executes attacker-supplied logic on the local host. The vulnerability requires local access and user interaction, but does not require privileges to trigger. Impact spans confidentiality, integrity, and availability of the affected workstation.
Root Cause
The root cause is insufficient validation and sanitization of inputs that are used during code generation within the CorvusSKK IME. Because the software constructs executable content from unvalidated data, attacker-controlled values are treated as trusted code. Details of the vulnerable component are documented in the JVN Advisory JVN18496672 and the GitHub Release 3.3.4 notes.
Attack Vector
An attacker delivers a crafted file, dictionary, or configuration artifact that CorvusSKK processes. When the victim opens or activates the artifact through the IME, the injected code executes in the user context. The attack requires local access to the target and interaction from the victim. Refer to the vendor advisory for verified technical details; no public proof-of-concept has been published.
Detection Methods for CVE-2026-76148
Indicators of Compromise
- Unexpected child processes spawned by the CorvusSKK IME host process on Windows endpoints.
- Creation or modification of CorvusSKK dictionary or configuration files from untrusted sources.
- Outbound network connections initiated by processes associated with the CorvusSKK installation directory.
Detection Strategies
- Hunt for process lineage anomalies where the IME process spawns command interpreters such as cmd.exe, powershell.exe, or wscript.exe.
- Monitor file writes into CorvusSKK configuration directories, especially where the source is a browser download or email client.
- Correlate installation of legacy CorvusSKK versions (below 3.3.4) with subsequent suspicious execution events.
Monitoring Recommendations
- Enable process creation and command-line auditing on Windows endpoints running Japanese IMEs.
- Ingest endpoint telemetry into a centralized data lake to enable retrospective hunts against the CorvusSKK process tree.
- Alert on modifications to IME configuration files performed by non-administrative or unattended processes.
How to Mitigate CVE-2026-76148
Immediate Actions Required
- Upgrade CorvusSKK to version 3.3.4 or later as published in the GitHub Release 3.3.4.
- Inventory Windows endpoints for installations of CorvusSKK and identify hosts running versions prior to 3.3.4.
- Restrict the ability of standard users to install or modify IME components on managed workstations.
Patch Information
The maintainer released CorvusSKK 3.3.4 to address this issue. Administrators should deploy the fixed version to all affected Windows endpoints. See the GitHub Release 3.3.4 notes and the JVN Advisory JVN18496672 for authoritative remediation guidance.
Workarounds
- Where patching is not immediately feasible, remove CorvusSKK from affected systems until the update can be applied.
- Block the delivery of untrusted CorvusSKK dictionary or configuration files through email and web gateways.
- Apply application allowlisting to prevent unauthorized modification of files within the CorvusSKK installation directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
