CVE-2026-10696: Use of an incorrectly resolved name or reference in the pinget backend

Synopsis

This is a name-resolution confusion vulnerability in the pinget backend of Devolutions UniGetUI versions 2026.2.1 and earlier. An attacker who is a WinGet community catalog contributor can craft a malicious catalog package whose normalized name appears as a substring within a legitimate installed application name, tricking the backend into correlating the two. When a user applies the proposed update, the attacker-controlled installer executes on the host. No fix has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious catalog package over the network via the WinGet community catalog, so the affected host must be able to reach that network service.

• AuthenticationNot required

  No authentication is required from the attacker; any WinGet community catalog contributor account is sufficient, and the victim-side trigger requires no credentials beyond normal user operation.

• Victim interactionRequired

  A user must apply the proposed update surfaced by UniGetUI, making this a social-engineering vector where the attacker relies on the user accepting a routine-looking update prompt.

• Attack complexityDetail

  Attack complexity is low: once the crafted package name is accepted into the catalog, the substring-match condition is reliably met without race conditions or special environmental tuning.

Blast Radius

• The attacker-controlled installer executes on the victim host with the privileges of the user who accepted the update, allowing arbitrary code to run.
• Installed software integrity is broken: the legitimate application entry is silently replaced or shadowed by attacker-controlled binaries.
• Depending on installer payload, the attacker can establish persistence, drop additional malware, or pivot to other processes running under the same user session.
• Availability of the affected application is disrupted if the malicious installer overwrites or corrupts the legitimate installation.