CVE-2026-120422

CVE Enrichment

CVSS: 8.9 HIGH
CISA KEV: Not listed

Description

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 04-Nov-2026 17:17
Last Modified: 04-Nov-2026 17:17

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:P /
                            VC:H /
                            VI:H /
                            VA:N /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:N /
                            AU:X /
                            R:U /
                            V:D /
                            RE:M /
                            U:X

CNA Products / Version Status

Sogou · Sogou Input Method Source: CNA · [email protected]
Default status: unaffected

0 ≤ version < 16.10 — affected (custom)

Platforms: Windows
Modules: SGTool.exe — HTTP configuration retrieval

References

Last enrichment sync: 05-Nov-2026 00:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Following responsible disclosure, Tencent addressed the vulnerability (CVE-2026-120422) in version 16.10, released on October 29, 2026, by migrating the affected HTTP requests to HTTPS. SlippyNunchucks Uses Sogou DNS Hijacking to Deliver DarkVigil
2026-11-02: ESET CNA issued a CVE ID for the vulnerability (CVE-2026-120422). ESET Details SlippyNunchucks’ Sogou Input Method Hijack to Deploy DarkVigil

CVE (2)

Malware (2)

People (1)

Threat Actors (2)

MITRE ATT&CK (12)

Vendors (2)

Products (5)

Industries (1)

Countries (13)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.