CVE-2026-124499 affects Feng Office's Translation Tool, where the write_translations function fails to properly handle the lang parameter, allowing an attacker to inject and execute code. The flaw can be triggered remotely without authentication, and a working exploit is already circulating publicly. Feng Office's maintainers reportedly have not responded to the disclosure, so no patched version is currently available.
// source: nvd.nist.gov ↗