CVE-2026-52103: n/a

This vulnerability (CVE-2026-52103) affects SimpleX Chat versions prior to 6.5. It is a zero-click remote code execution (RCE) vulnerability located in the /Terminal/Notification.hs component. An attacker can exploit this by sending a crafted payload in a text message, which triggers arbitrary command execution in the application's context without requiring user interaction. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system with the privileges of the SimpleX Chat application, potentially leading to full compromise of the application environment. The attack requires no user interaction and can be triggered remotely via network by sending a crafted text message. This poses a critical risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when receiving unexpected text messages and consider disabling or restricting the vulnerable component if possible. Monitor vendor channels for updates regarding patches or mitigations.