Dashboard / CVE-2026-42881

CVE-2026-42881

HIGH
MEDIUM Priority: 0.02 BB Relevance: 42/100
Published: 2026-05-14 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Active
S: X
AT: None
VC: High
VI: High
VA: High

Description

STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter. This requires user interaction: the victim must open the malicious .stigqter file and explicitly run the "Export HTML" action. This vulnerability is fixed in 1.2.7.

Weakness Classification (2)

References & Advisories (3)

Bug Bounty Relevance

42 / 100
✓ No authentication
✓ Low complexity

CVSS Score

8.4 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.23%
Raw Score 0.002280
Percentile 13.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00228
2026-10-28
0.00228

Intelligence Sources

nvd ref →

External Links