Sogou Input Method for Windows has a vulnerability in the SGTool.exe component's configuration retrieval mechanism. It fetches configuration data over unencrypted HTTP, allowing attackers who can manipulate network traffic to replace legitimate responses with malicious configurations. This enables attackers to cause SGTool.exe to download attacker-controlled files to arbitrary locations, potentially leading to arbitrary code execution when those files are executed or loaded.