CVE-2026-77092

Content Extractor contains a deserialization of untrusted data flaw (CWE-502) that affects privilege management, meaning crafted serialized input can subvert the product's privilege handling. The CVSS 4.0 vector indicates exploitation requires low privileges on the local system with no user interaction, but a high attack complexity and the presence of required preconditions (AT:P) make reliable exploitation harder to pull off. A successful attacker achieves high confidentiality, integrity, and availability impact on the vulnerable system — consistent with privilege escalation or code execution on that host — with no impact spreading to downstream systems. Users of Content Extractor running a version prior to the resolved maintenance release are affected; the advisory does not specify affected or fixed version numbers. There is no public proof of concept, the issue is not in CISA KEV, and EPSS puts exploitation probability at about 0.2% over 30 days, so no exploitation is currently known.

What to do: Update Content Extractor to the resolved maintenance release as directed by the vendor, and confirm the exact fixed version number with them since the advisory omits it. Until patched, restrict low-privileged local access to systems running Content Extractor and review where it deserializes externally supplied data. Prioritize patching hosts where untrusted users can reach the product, given the local attack vector.