The TrueConf Client retrieves update files from a specified source and installs them without performing integrity checks such as cryptographic signatures or checksums. Because no verification is performed, a malicious payload supplied on the update path can be executed during installation, giving the attacker arbitrary code execution privileges in the context of the updater or the end user. This behaviour is consistent with CWE‑494, which relates to the exploitation of insecure data.

All installations of TrueConf Client that use the automatic update mechanism are potentially impacted. The CNA identifies the product as TrueConf Client, but no particular versions are excluded or specifically listed; consequently, any release prior to the integrity‑checking update is at risk.

The CVSS score of 7.8 places the vulnerability in the high‑severity range. The description states that the attacker only needs to influence the update delivery path; the CVE does not specify the precise method, but control of that path would enable a malicious update to be downloaded and executed. No user interaction is required beyond this influence. While an EPSS score is unavailable and the vulnerability is not catalogued in CISA’s KEV, the vendor has released fixes that address the underlying issue.