CVE-2026-3502: TrueConf Client Download of Code Without Integrity Check Vulnerability

TrueConf Client contains a download of code without integrity check vulnerability. An attacker able to influence the update delivery path can substitute a tampered payload. Execution of that payload during the update process can result in arbitrary code execution in the context of the updater or the affected user account. This matters because endpoint clients that pull and run updates without verification create a direct path for code execution on managed devices.

How it works

The weakness is categorized as CWE-494. The client retrieves update content over a path an attacker can influence and does not verify the integrity of the received payload before execution or installation. Substitution of the payload therefore allows the attacker-supplied code to run with the privileges of the update process or the logged-in user. No further client-side checks are described in the available summary.

Am I affected? How to find it in your systems

Inventory all installations of TrueConf Client on endpoints and any systems that receive updates through the affected mechanism. Confirm the presence of the client software and review its update configuration against the vendor advisory. Because the vulnerability concerns the update path, examine network routes used for client updates and any proxy or internal distribution points that could be altered. No specific log signatures or telemetry indicators are provided in the summary; monitor standard process-creation and file-write events around the client updater executable for unexpected behavior.

How to remediate

Apply the vendor-supplied update that addresses the integrity check. After patching, review the client configuration to ensure updates are delivered only from trusted sources and that any available integrity verification options are enabled. For this class of weakness, restrict update sources to authenticated internal repositories where feasible and limit the ability of users to trigger or approve updates outside controlled channels.

If you can't patch immediately

Follow the vendor instructions for available mitigations. Where the client is used with cloud services, apply the controls required by BOD 22-01. Segment networks so that endpoints running the client cannot reach arbitrary external update locations. Consider disabling automatic updates until a verified package can be supplied through a controlled channel. Monitor update-related processes and network connections for anomalies while the exposure remains. If mitigations cannot be applied, discontinue use of the product.

If your data may have been exposed

Actively exploited instances of this vulnerability class have led to unauthorized code execution and subsequent data access. Run a free exposure scan of your organization's email addresses against known breach data to determine whether related credentials or accounts appear in public records.