Threats tagged 'ghsa-25hq-wqc9-cgfc'

Magic: The Gathering Arena (Windows/Steam client) versions 2026.59.30.12801.127931.6 and certain later 2026.60.x builds have a vulnerability where a server-supplied URL from the home-screen carousel is passed directly to the Windows shell without validating the URI scheme or domain. This can allow an attacker controlling carousel content to invoke arbitrary registered URI-scheme handlers on client hosts without user interaction. The vulnerability is classified as CWE-99 (Improper Control of Resource Identifiers) and has a low CVSS score of 3.4.