GCVE-1988-2026-0059

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nvMix 29 ships a Windows-native .NET Framework application with a built-in Web Controller HTTP server on port 8088. The \nHTTP API endpoint GET /api/?Function=ScriptStartDynamic&Value=<VB.NET source> takes the Value parameter as VB.NET \nsource code, compiles and executes it via VBScriptProvider.Compile. vMix attempts to sandbox user-supplied scripts with \na 6-item substring blocklist, but the compilation template injects Imports System.Diagnostics into the generated source \nbefore the user's code, so an attacker can call Process.Start directly without writing the blocked substring. Combined \nwith the Web Controller's default blank password (which the official documentation states means no login will be \nrequired regardless of the access settings), the entire /api route is reachable without authentication, yielding \nunauthenticated RCE as the user running vMix64.exe (commonly administrator). Pre-research public CVE count for vMix: 0.\n\nImpact: Arbitrary OS command execution as the vMix64.exe run identity (commonly administrator), plus arbitrary file \nread/write via the same blocklist bypass; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/12"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0059",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12",
            "automated": true,
            "contentSha256": "1df256062c2f41c79c2944d415b239febfede190eab238ad05d63e79486a530d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0059"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}