In the TrueConf Client, the update mechanism does not verify the integrity of downloaded code before installation. An attacker who can direct the client to an alternative update server can supply a malicious payload. When the updater applies this payload, arbitrary code executes with the privileges of the updater or the current user, enabling full compromise of the affected machine.

The vulnerability affects the TrueConf Client application. The CVE description does not specify a build or version that is affected. Based on the references provided, it is inferred that all versions prior to the 8.5 update are vulnerable. Therefore, users running any installation of TrueConf Client older than 8.5 should consider the software at risk.

The CVSS score of 7.8 reflects a high severity level. The EPSS probability of 6 % indicates a moderate likelihood of exploitation, suggesting that attackers may find this vulnerability more viable than previously thought. The entry is marked in CISA’s KEV catalog, confirming that it has been targeted in the wild. Given the nature of the update path, the most likely attack vector is remote delivery of a forged update, requiring the victim to have the TrueConf Client running and fetching updates.