The vulnerability CVE-2026-55979 arises from an improper access control check in CatchPulse's named pipe communication interface. This weakness allows an attacker with low privileges on the local system to invoke CatchPulse functions that should be protected by more restrictive security policies. The CVSS 3.1 base score is 5.2 (medium), with attack vector local, low attack complexity, low privileges required, no user interaction, scope changed, partial confidentiality impact, no integrity impact, and low availability impact. There is no indication of known exploits in the wild or available patches at this time.

An attacker with local access and low privileges could exploit this vulnerability to invoke certain CatchPulse functions that are intended to be more securely restricted. This could lead to partial disclosure of information and some degradation of availability. There is no impact on integrity. The scope of the vulnerability is changed, meaning the attack affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a fix is available, restrict local access to trusted users only and consider additional local access controls to limit exploitation opportunities.