CVE-2026-76149 Overview
CVE-2026-76149 is an integer overflow vulnerability [CWE-190] affecting CorvusSKK, an SKK-style Japanese Input Method Editor (IME) for Windows. The flaw allows malicious data to be written to a dictionary file when arithmetic operations exceed integer boundaries during dictionary processing. Exploitation requires local access and user interaction, limiting the attack surface to scenarios where an attacker can influence input processed by the IME. The maintainer addressed the issue in CorvusSKK version 3.3.4.
Critical Impact
An integer overflow during dictionary file operations can corrupt user dictionary content, resulting in limited integrity and availability impact on the affected system.
Affected Products
- CorvusSKK versions prior to 3.3.4
- Windows systems running the vulnerable IME
- User dictionary files managed by CorvusSKK
Discovery Timeline
- 2026-08-26 - CVE-2026-76149 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-76149
Vulnerability Analysis
CorvusSKK contains an integer overflow flaw in the code path that processes dictionary file data. When arithmetic operations on size or length values exceed the maximum representable integer, the resulting wrapped value causes incorrect memory or file allocation logic. An attacker who can supply crafted input to the IME can leverage this condition to write unintended data to a dictionary file.
Exploitation requires local access and active user interaction with the IME. The attack does not cross a trust boundary remotely and does not yield confidentiality impact. Integrity and availability effects remain limited to the local user context and the dictionary file managed by CorvusSKK.
Root Cause
The root cause is an unchecked arithmetic operation involving size or length values during dictionary file handling, classified under [CWE-190] Integer Overflow or Wraparound. When the computed value wraps, subsequent write operations proceed with an invalid size assumption, allowing malicious content to be persisted into the dictionary file.
Attack Vector
The attack vector is local and requires user interaction. An attacker must induce a user running CorvusSKK to process crafted input that triggers the overflow condition. No network access, elevated privileges, or authentication are required beyond the local user session. See the JVN Security Advisory JVN18496672 for coordinated disclosure details.
No public proof-of-concept exploit or in-the-wild exploitation has been reported for this vulnerability.
Detection Methods for CVE-2026-76149
Indicators of Compromise
- Unexpected modifications, corruption, or unusual entries in CorvusSKK user dictionary files
- Presence of CorvusSKK binaries with versions earlier than 3.3.4 in the installation directory
- Anomalous crashes or restarts of the CorvusSKK IME process on Windows endpoints
Detection Strategies
- Inventory installed IME software across Windows endpoints and flag any CorvusSKK installation below version 3.3.4
- Monitor file integrity on CorvusSKK dictionary file paths to identify unauthorized writes
- Correlate process telemetry for CorvusSKK with abnormal file write patterns to user dictionary locations
Monitoring Recommendations
- Enable endpoint file integrity monitoring for CorvusSKK dictionary directories under user profiles
- Collect process creation and file modification events for the CorvusSKK executable through EDR telemetry
- Alert on version drift when CorvusSKK is deployed inconsistently across managed endpoints
How to Mitigate CVE-2026-76149
Immediate Actions Required
- Upgrade CorvusSKK to version 3.3.4 or later on all affected Windows endpoints
- Verify the installed version through the application properties or package manifest after upgrade
- Restore any suspected corrupted dictionary files from a known-good backup
Patch Information
The maintainer released CorvusSKK version 3.3.4 addressing this integer overflow. Download the patched release from the GitHub CorvusSKK Release 3.3.4 page. Refer to the JVN Security Advisory JVN18496672 for coordinated advisory information.
Workarounds
- Restrict use of CorvusSKK on endpoints handling untrusted input until the patch is applied
- Limit write permissions on dictionary file locations to reduce persistence of malicious data
- Remove CorvusSKK from systems where the IME is not required for business function
# Verify installed CorvusSKK version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*CorvusSKK*" } |
Select-Object DisplayName, DisplayVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
