CVE-2026-81574: CodeMeter Runtime Format String DOS Vulnerability

CVE-2026-81574 Overview

CVE-2026-81574 is a format string vulnerability in WIBU-SYSTEMS CodeMeter Runtime affecting versions before 8.41a and 9.10. The logger fails to sanitize input strings in specific code paths, allowing an attacker to inject printf-style format specifiers. Successful exploitation crashes the CodeMeter service and discloses sensitive process memory, including stack canaries used to defeat exploit mitigations. Attackers can exploit the flaw locally through cmu --set-proxy and remotely when chained with CVE-2026-81573 by manipulating the General.ProxyServer setting. The issue is tracked under [CWE-134: Use of Externally-Controlled Format String].

Critical Impact
Remote unauthenticated attackers can crash CodeMeter Runtime and leak memory contents, including stack canaries that protect against memory corruption exploitation.

Affected Products

WIBU-SYSTEMS CodeMeter Runtime versions before 8.41a
WIBU-SYSTEMS CodeMeter Runtime 9.x versions before 9.10
Applications and industrial systems that rely on CodeMeter Runtime for license management

Discovery Timeline

2026-08-27 - CVE-2026-81574 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-81574

Vulnerability Analysis

CodeMeter Runtime is a licensing and protection component used across industrial software, engineering tools, and enterprise applications. The vulnerability resides in the logging subsystem, which passes attacker-controlled input directly to a printf-family function without a fixed format string. When user input contains format specifiers such as %s, %x, or %n, the logger interprets them as directives rather than literal text. This causes the process to read arbitrary values from the stack or dereference invalid pointers.

Disclosed memory can include stack canaries, return addresses, and pointer values from the running process. Leaking these values weakens protections like Address Space Layout Randomization (ASLR) and stack cookie enforcement. The vulnerability also produces reliable crashes, denying licensing services to dependent applications.

Root Cause

The root cause is improper input validation in the logger. Format specifiers embedded in log arguments are evaluated instead of escaped. This matches the classic pattern described in [CWE-134], where externally controlled input reaches a format string parameter.

Attack Vector

A local attacker invokes cmu --set-proxy with a payload containing format specifiers, which the logger then processes. Remote exploitation is possible when combined with CVE-2026-81573: an attacker sets General.ProxyServer to a malicious value and triggers the logging path that consumes it. The remote chain requires no authentication and no user interaction.

See the WIBU Security Advisory #103401 for vendor-provided technical details on the exploitation path.

// Vulnerability pattern (illustrative, not verified source)
// The logger receives attacker-controlled input and passes it as the format string:
//   log_write(user_input);        // vulnerable
// Correct usage would be:
//   log_write("%s", user_input);  // safe

Detection Methods for CVE-2026-81574

Indicators of Compromise

CodeMeter Runtime process crashes or unexpected restarts of CodeMeter.exe or CodeMeterLin
CodeMeter log entries containing raw format specifiers such as %s, %x, %p, or %n
General.ProxyServer configuration values containing non-URL characters or format tokens
Invocations of cmu --set-proxy with unusual or malformed proxy strings

Detection Strategies

Parse CodeMeter log files for occurrences of % sequences within fields that should contain URLs or hostnames
Monitor process telemetry for abnormal termination of CodeMeter service binaries followed by automatic restarts
Alert on modifications to CodeMeter configuration keys, particularly General.ProxyServer, from non-administrative sources

Monitoring Recommendations

Enable command-line auditing on hosts running CodeMeter to capture cmu invocations and arguments
Forward CodeMeter logs and process events to a centralized SIEM for correlation with configuration changes
Track network flows to the CodeMeter service port to identify remote configuration attempts

How to Mitigate CVE-2026-81574

Immediate Actions Required

Upgrade CodeMeter Runtime to version 8.41a, 9.10, or later on all endpoints and servers
Restrict network access to the CodeMeter service so only trusted management hosts can reach it
Audit existing General.ProxyServer values and reset any that contain suspicious characters

Patch Information

WIBU-SYSTEMS has released fixed builds. Apply CodeMeter Runtime 8.41a for the 8.x branch or 9.10 for the 9.x branch. Refer to the WIBU Security Advisory #103401 for download links and version-specific guidance. Because CVE-2026-81574 is chainable with CVE-2026-81573, apply both fixes together.

Workarounds

Limit local access so only administrators can run cmu and modify CodeMeter configuration
Block untrusted networks from reaching the CodeMeter service port using host or network firewalls
Validate proxy configuration values before applying them and reject inputs containing % characters where not expected

bash

# Example: restrict access to the CodeMeter service port on Linux hosts
sudo iptables -A INPUT -p tcp --dport 22350 -s <trusted-management-subnet> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22350 -j DROP

# Verify installed CodeMeter Runtime version
cmu --version