Critical · published August 19, 2026
CVSS calls it critical at 9.0. It is confirmed in active exploitation. It sits in the 76.8th percentile for exploit probability.
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.
| Product | Versions | Fixed in |
|---|---|---|
| trueconf/trueconf_server | < 5.3.9.10013 | 5.3.9.10013 |
| trueconf/trueconf_server | < 5.3.9.10015 | 5.3.9.10015 |
| trueconf/trueconf_server | ≥ 5.4.0.12689, < 5.4.9.10072 | 5.4.9.10072 |
| trueconf/trueconf_server | ≥ 5.4.0.12700, < 5.4.9.10019 | 5.4.9.10019 |
| trueconf/trueconf_server | ≥ 5.5.0.13826, < 5.5.5.10010 | 5.5.5.10010 |
| trueconf/trueconf_server | ≥ 5.5.0.13828, < 5.5.5.10009 | 5.5.5.10009 |