High severity7.8NVD Advisory· Published Jun 9, 2017· Updated May 13, 2026

CVE-2016-7838

Description

Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.

Affected products

Winsparkle/Winsparkle2 versions
cpe:2.3:a:winsparkle:winsparkle:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:winsparkle:winsparkle:*:*:*:*:*:*:*:*range: <=0.5.2
- (no CPE)range: versions prior to 0.5.3

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/vslavik/winsparkle/commit/bb454857348245a7397f9e4fbb3a902f4ac25913nvdPatchThird Party Advisory
www.securityfocus.com/bid/95099nvdThird Party AdvisoryVDB Entry
jvn.jp/en/jp/JVN90813656/index.htmlnvdThird Party AdvisoryVDB Entry
jvn.jp/en/jp/JVN96681653/index.htmlnvdThird Party AdvisoryVDB Entry
www.wireshark.org/news/20161214.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000