SecBoard
Zurück zur CVE-Übersicht

CVE-2026-48056

CRITICAL(10.0)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 10 — Kritisch

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

10

Technische Schwere

Beschreibung

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 2.5.0

Threat-Hunting-Queries

Die Schwachstelle ermöglicht die Ausführung beliebiger lokaler Binärdateien. Die Erkennung sollte auf ungewöhnliche Prozessstarts durch die Streambert-Anwendung abzielen, insbesondere auf die Ausführung von Shells oder anderen Systemprogrammen.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "streambert.exe" or InitiatingProcessFileName =~ "streambert"
| where FileName in ("cmd.exe", "powershell.exe", "sh", "bash", "pwsh", "python.exe", "perl.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=linux_audit) (ParentProcessName="streambert.exe" OR ParentProcessName="streambert") (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*/bin/sh" OR Image="*/bin/bash" OR Image="*\\pwsh.exe" OR Image="*\\python.exe" OR Image="*\\perl.exe")
| table _time, host, ParentProcessName, Image, CommandLine

Sigma

title: Streambert Arbitrary Binary Execution
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious process creation by Streambert application, indicative of CVE-2026-48056 exploitation.
author: SecBoard
date: 2026/05/22
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\streambert.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh'
      - '\bash'
      - '\pwsh.exe'
      - '\python.exe'
      - '\perl.exe'
  condition: selection
falsepositives:
  - Legitimate use of Streambert (unlikely to spawn shells directly)
level: critical

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable : "streambert.exe" or process.parent.executable : "streambert") and (process.executable : "cmd.exe" or process.executable : "powershell.exe" or process.executable : "sh" or process.executable : "bash" or process.executable : "pwsh.exe" or process.executable : "python.exe" or process.executable : "perl.exe")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

In diesen Analysen erwähnt

Wochenlage KW33: Linux Kernel, IBM WebSphere und kritische CVEs im FokusSecBoard

Referenzen