A flaw in the firmware verification logic of Creative Sound Blaster Katana devices enables an attacker to construct a counterfeit firmware image that bypasses the authenticity check. The device will accept and install this forged firmware, giving the attacker the ability to execute arbitrary code, persist malicious components, and undermine the confidentiality, integrity, and availability of the device and any systems it serves.

The affected devices are Creative Sound Blaster Katana V2, V2X, and SE models produced by Creative Labs. Any firmware installed on these models that relies on the vulnerable verification routine is potentially impacted; no specific firmware build numbers are provided, so current or legacy firmware may be at risk.

The CVSS base score of 9.6 marks the vulnerability as critical. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would likely need the ability to reach the device’s firmware update interface, either physically or through a compromised network segment, to deliver the modified firmware.