TrueConf Client versions 8.1.0 through 8.5.2 are vulnerable to a code integrity verification bypass during the update process. The client downloads update code and applies it without performing any integrity checks, allowing an attacker who can influence the update delivery path to substitute malicious code. Successful exploitation results in arbitrary code execution in the context of the updating process or user. The vulnerability is tracked as CWE-494 (Download of Code Without Integrity Check) and has a CVSS 3.1 base score of 7.8, indicating high severity. There is no information about available patches or vendor advisories at this time.

If exploited, this vulnerability allows an attacker to execute arbitrary code with the privileges of the user or process performing the update. This can lead to full compromise of the affected system or user environment. The attack requires the ability to influence the update delivery path, which may limit the attack surface but still represents a significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict network paths that could be used to tamper with update delivery and consider disabling automatic updates if feasible. Monitor TrueConf advisories for updates and apply patches promptly once released.