In the TrueConf Client, the update mechanism does not verify the integrity of downloaded code before installation. An attacker who can direct the client to an alternative update server can supply a malicious payload. When the updater applies this payload, arbitrary code executes with the privileges of the updater or the current user, enabling full compromise of the affected machine.

The vulnerability affects the TrueConf Client application. The CVE does not specify which build or version exhibits the flaw; however the references indicate that versions prior to the 8.5 update are vulnerable. Users running an affected instance should therefore treat all installations of TrueConf Client before the 8.5 release as at risk.

The CVSS score of 7.8 reflects a high severity level. The EPSS probability under 1 % suggests that while the flaw is serious, active exploitation remains rare. The entry is marked in CISA’s KEV catalog, confirming that it has been targeted in the wild. Given the nature of the update path, the most likely attack vector is remote delivery of a forged update, requiring the victim to have the TrueConf Client running and fetching updates.