CVE-2021-28927
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the ac
CVSS
7.8
Alto
EPSS
1.4%
p69
KEV
—
Exploit Today
21
0-100
Publicado: 7 abr 2021 · Última mod.: 9 jul 2026 · CWE-78
1.4%EPSS · 30 días1.5%
2026-06-302026-07-16
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.
- github.comhttps://github.com/libretro/RetroArch/blob/d3dc3ee989ec6a4903c689907ffc47027f71f776/frontend/drivers/platform_win32.c
- labs.bishopfox.comhttps://labs.bishopfox.com/advisories/retroarch-for-windows-version-1.9.0
- github.comhttps://github.com/libretro/RetroArch/blob/d3dc3ee989ec6a4903c689907ffc47027f71f776/frontend/drivers/platform_win32.c
- labs.bishopfox.comhttps://labs.bishopfox.com/advisories/retroarch-for-windows-version-1.9.0
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-341978.8 ALT99.9%
KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2dCVE-2024-121210.0 CRÍ99.9%
KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability3dCVE-2022-262589.8 CRÍ99.6%
KEV—80D-Link DIR-820L Remote Code Execution Vulnerability8dCVE-2026-422718.8 ALT99.6%
KEV—80BerriAI LiteLLM Command Injection Vulnerability2dCVE-2021-252988.8 ALT99.5%
KEV—80Nagios XI OS Command Injection8dCVE-2021-252978.8 ALT98.9%
KEV—80Nagios XI OS Command Injection8d