TrueConf Client Update Integrity Check Bypass Leading to Arbitrary Code Execution
CVE-2026-3502 is a vulnerability in the TrueConf Client update mechanism in which the client downloads and applies update code without properly verifying the integrity and authenticity of the update package. The flaw affects the updater validation logic used when clients retrieve updates from a centrally managed TrueConf server, including on-premises deployments. Reporting indicates the vulnerable update flow fetches the client installer from the server and trusts the package without adequate cryptographic verification, allowing a tampered update to be accepted as legitimate. An attacker who can control, compromise, or otherwise influence the update delivery path or the on-premises TrueConf server can replace the legitimate update package with a malicious executable or installer. When the client executes or installs that package through the normal update process, arbitrary code can run in the security context of the updating process or logged-in user. In observed exploitation, attackers weaponized the update channel to distribute malware to multiple connected endpoints.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a standalone Python exploit toolkit for a claimed TrueConf Windows update hijacking issue, CVE-2026-3502. It is not tied to a common exploit framework. The structure contains four main code files: `exploit.py` (primary exploit simulation and reporting), `detectors/vulnerability_checker.py` (server/client/IOC checker), `malicious_update_builder.py` (builder for a malicious update package using generated C stubs and an Inno Setup script), and `update_server.py` (Flask-based fake update server for MITM or server-compromise simulation). Supporting files include `README.md`, usage notes, requirements, and an example output file. Main exploit capability: `exploit.py` checks whether a target exposes `/downlods/trueconf_client.exe` and treats missing `ETag`/`Last-Modified` headers as evidence of weak integrity protection. It can then simulate an attack by validating a supplied malicious EXE, hashing it, printing deployment steps, and generating a JSON report. It does not automatically compromise the target server; instead, it operationalizes the attack workflow by documenting how to replace the server-hosted update binary in `C:\Program Files\TrueConf Server\ClientInstFiles\trueconf_client.exe`. The builder component is more aggressive: `malicious_update_builder.py` generates source for a DLL sideload payload (`7z-x64.dll`), an Inno Setup installer script, and decoy binaries. The generated installer script drops files under `C:\ProgramData\PowerISO`, launches a client binary, adds persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UpdateCheck`, and creates a scheduled task `TrueConfUpdate`. The DLL payload is demonstrative but includes a proof action writing `C:\ProgramData\pwned.txt`; comments reference downloading a Havoc payload from `http://attacker.com/havoc.exe`. `update_server.py` provides a fake TrueConf server with routes `/downlods/trueconf_client.exe`, `/config`, `/version.js`, and `/`, allowing an operator to serve a malicious update and spoof version metadata to clients. `detectors/vulnerability_checker.py` performs HEAD requests to the update endpoint, checks local Windows install paths for vulnerable client versions, and looks for IOC artifacts such as dropped files, Run keys, and scheduled-task references. Overall, this is an operational proof-of-concept repository for malicious update delivery in a Windows enterprise/internal-network scenario. It combines vulnerability checking, fake infrastructure, payload packaging, and deployment guidance. While some actions are simulated and several payload steps are instructional rather than fully automated, the repository clearly aims to demonstrate arbitrary code execution through update hijacking and includes persistence-oriented payload examples.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
65 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical TrueConf Client vulnerability caused by improper integrity/authenticity verification of software updates, enabling attackers to substitute malicious updates and achieve arbitrary code execution.
A TrueConf Client vulnerability that allows unverified update downloads and installations, enabling attackers who can tamper with the update source to deliver malicious files and achieve arbitrary code execution.
A vulnerability in the TrueConf video conferencing software's updater validation mechanism that allows an attacker controlling an on-premises TrueConf server to distribute and execute arbitrary files across connected endpoints.
A zero-day vulnerability in the TrueConf client update mechanism that allows malicious update packages to be delivered and installed without integrity verification, enabling malware deployment inside targeted networks.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.