CVE-2024-28886

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-28 · updated 2026-06-17
Weakness: CWE-94

Description

OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitrary OS command may be executed.

Affected products

Ameya Ayame Utau: before 0.4.19 — fixed in 0.4.19

How to fix

Upgrade to a fixed version: Ameya Ayame Utau 0.4.19. Check the vendor advisory for mitigations.

References

https://jvn.jp/en/jp/JVN71404925/
https://utau2008.xrea.jp/
https://jvn.jp/en/jp/JVN71404925/
https://utau2008.xrea.jp/

Get alerted when CVE-2024-28886 or the next vulnerability affects your stack