CVE-2026-107448: CWE-99 Improper Control of Resource Identifiers ('Resource Injection') in Wizards of the Coast Magic: The Gathering Arena

Magic: The Gathering Arena (Windows/Steam client; version 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain. An attacker able to control the carousel content delivered to clients could cause arbitrary registered URI-scheme handlers to be invoked on client hosts without user interaction. For example, the carousel might be expected to contain only https: URIs, but could be manipulated to include other schemes like ms-calculator:.

The vulnerability allows an attacker who can control the carousel content to cause arbitrary URI-scheme handlers to be invoked on affected client hosts without user interaction. This could lead to limited impact such as launching unintended applications or actions via registered URI schemes. The CVSS score of 3.4 reflects low severity with no direct confidentiality or availability impact, but with limited integrity impact.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about the source of carousel content and avoid untrusted network environments where an attacker might influence the carousel data. No specific vendor mitigation or 'no action required' statement is provided.