Configuration Retrieval Flaw in Sogou Input Method by Sogou

CVE-2026-120422

What is CVE-2026-120422?

The Sogou Input Method for Windows suffers from a vulnerability within its SGTool.exe component that improperly retrieves configuration data over unencrypted HTTP connections. This design flaw allows an attacker, capable of intercepting network traffic, to alter legitimate server responses and inject malicious configurations. As a result, the compromised SGTool.exe can be manipulated into downloading files controlled by the attacker to arbitrary locations, potentially leading to execution of arbitrary code when the malicious files are run or loaded by the application.

References