CVE-2026-30266
Published: 20 April 2026
Summary
CVE-2026-30266 is a high-severity Insecure Inherited Permissions (CWE-277) vulnerability in Deepcool Deepcreative. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to files and resources in DeepCreative, directly preventing local attackers from exploiting insecure permissions to execute arbitrary code via crafted files.
Employs least privilege for DeepCreative processes, ensuring minimal permissions that mitigate arbitrary code execution from insecure file permissions even if exploited.
Establishes secure configuration settings for file permissions in DeepCreative, addressing CWE-277 by restricting access to prevent crafted file-based code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure permissions vulnerability enables local arbitrary code execution when a user opens a crafted file (UI:R), directly mapping to malicious file user execution.
NVD Description
Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file
Deeper analysisAI
CVE-2026-30266 is an Insecure Permissions vulnerability (CWE-277) in DeepCool DeepCreative version 1.2.12 and prior versions. Published on 2026-04-20, it allows a local attacker to execute arbitrary code via a crafted file. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact.
Exploitation requires local access to the system with no privileges (PR:N), low attack complexity, and user interaction such as opening the crafted file. A successful attack grants the attacker high-level access to confidentiality, integrity, and availability, enabling arbitrary code execution that could result in full compromise of the affected system.
Vendor sites at http://deepcool.com and http://deepcreative.com, along with research at https://github.com/uncle-hash/vulnerability-research/tree/main/CVE-2026-30266, provide further details on the vulnerability.
Details
- CWE(s)