CVE-2026-45353

HIGH

electerm: Local code through electerm's single-instance socket

Title source: cna

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0.

Core 2

Core References

X_Refsource_Confirm x_refsource_confirm

X_Refsource_Misc x_refsource_misc

CVSS v3 7.8

EPSS 0.0011

EPSS Percentile 1.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-732 CWE-94 CWE-940

Status published

Products (2)

electerm/electerm >= 3.0.6, < 3.89.0

electerm_project/electerm 3.0.6 - 3.9.0

Published May 28, 2026

Tracked Since May 28, 2026