CVE-2026-8993 is an injection-related vulnerability (CWE-74) in the D.Launcher 2 component of the Slovak eID client ecosystem by Ditec a.s. The application registers multiple custom URL handlers that improperly neutralize special elements in output used by downstream components. This improper URL handler processing can be exploited by attackers to initiate full NTLM authentication or SMB connections to attacker infrastructure and conduct SSRF attacks. Exploitation requires user interaction to open a specially crafted URL. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5 (Network attack vector, low attack complexity, no privileges required, user interaction required, high confidentiality impact, no integrity or availability impact). There is no vendor advisory or patch available at this time.

Successful exploitation can lead to disclosure of sensitive information via NTLM authentication or SMB connections to attacker-controlled systems and enable SSRF attacks, potentially allowing attackers to interact with internal services. However, exploitation requires user interaction and does not impact integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening URLs from untrusted sources, especially those invoking custom URL handlers related to D.Launcher 2. No official mitigation or temporary fix has been documented.