{"id":"CVE-2026-118450","kind":"vulnerability","aliases":["CVE-2026-118450"],"related":[],"title":"Venere: unsigned components load from user-writable install locations","description":"Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.","summary":"Venere, when installed outside Program Files, loads and registers unsigned components from folders an unprivileged user can write to. A local user could plant a component there that the application then runs or registers.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","venere","windows"],"not_affected_if":["installed-in-program-files"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:24+00:00","updated_at":"2026-11-09T12:27:24+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T12:27:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Venere: unsigned components load from user-writable install locations","impact":"medium","summary":"Venere, when installed outside Program Files, loads and registers unsigned components from folders an unprivileged user can write to. A local user could plant a component there that the application then runs or registers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","venere"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs code through planted unsigned component","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118450 for the affected Venere versions, the vendor name and any fixed release.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["installed-in-program-files"],"who_is_affected":"Only installations of Venere placed outside Program Files, where unprivileged users can create files in the directories the product loads components from. Installs in Program Files are described as not affected by this issue. The sources do not name the affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":4483,"output_tokens":423,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118450':13A,16A '-2026':12A,15A 'applic':49B 'compon':3A,30B,45B,63C 'could':42B 'creat':71C 'cve':11A,14A 'file':25B,59C,72C 'folder':32B 'instal':9A,22B,56C 'load':4A,26B 'loads/registers':61C 'local':40B 'locat':10A,65C 'may':70C 'outsid':23B,57C 'plant':43B 'program':24B,58C 'regist':28B,53B 'run':51B 'unprivileg':34B,68C 'unsign':2A,29B,62C 'user':7A,35B,41B,69C 'user-writ':6A 'vener':1A,18B,20B,54C 'window':19B 'writabl':8A 'write':37B","nicknames":[],"mitigations":[],"who_affected":"Only installations of Venere placed outside Program Files, where unprivileged users can create files in the directories the product loads components from. Installs in Program Files are described as not affected by this issue. The sources do not name the affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","venere","windows"],"campaign_type":null,"search_a":"'-118450':13A,16A '-2026':12A,15A 'compon':3A 'cve':11A,14A 'instal':9A 'load':4A 'locat':10A 'unsign':2A 'user':7A 'user-writ':6A 'vener':1A 'writabl':8A","search_b":"'applic':49B 'compon':30B,45B 'could':42B 'file':25B 'folder':32B 'instal':22B 'load':26B 'local':40B 'outsid':23B 'plant':43B 'program':24B 'regist':28B,53B 'run':51B 'unprivileg':34B 'unsign':29B 'user':35B,41B 'vener':18B,20B 'window':19B 'write':37B","search_c":"'compon':63C 'creat':71C 'file':59C,72C 'instal':56C 'loads/registers':61C 'locat':65C 'may':70C 'outsid':57C 'program':58C 'unprivileg':68C 'unsign':62C 'user':69C 'vener':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118450","severity":null,"published_at":"2026-11-09T12:16:36+00:00","modified_at":"2026-11-09T12:16:36+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}