Origin Validation Error in Legacy Update Tool for Windows PCs

CVE-2026-97381

What is CVE-2026-97381?

The Legacy Update tool, used for managing updates on older Windows PCs, contains an origin validation error in its ActiveX control. This vulnerability allows attackers to exploit the IsPermitted method. If a user visits a malicious webpage using Internet Explorer, the absence of proper hostname checks can enable the control to bypass necessary access restrictions. Consequently, this could lead to unauthorized actions such as enumerating system and update information, installing updates without user consent, displaying unauthorized dialogs, or even restarting the system while a reboot is pending. The issue has been rectified in version 1.13.2 of Legacy Update.

References