An unauthenticated remote attacker can trigger execution of arbitrary code in the Sogou Input Method before version 16.3.0.3498 by interacting with the biz_helper.exe component. This flaw is a classic code injection vulnerability (CWE‑94). When exploited, the attacker gains full control over the affected system, allowing execution of any code with the privileges of the user running the Input Method. The vulnerability carries a CVSS score of 9.8, indicating critical severity.

The issue affects the Sogou Input Method distributed for Windows, specifically releases older than version 16.3.0.3498. The vendor released a fix in the 16.3.0.3498 update that patches the biz_helper.exe component. Users running earlier releases should verify and upgrade to at least 16.3.0.3498 or newer.

The EPSS score is <1 %, suggesting that the exploitation likelihood is low, and there is no record in the CISA KEV catalog. Nevertheless, the vulnerability’s high CVSS rating and the potential for total system compromise mean that it should be treated with high priority. The attack vector is remote, as the flaw can be triggered without local privileges, though the exact method of delivery is not detailed in the description.