CVE-2026-107448 in Magic The Gathering Arena
Summary
by MITRE • 10/08/2026
Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain. A hypothetical attacker able to control the carousel content delivered to clients can cause arbitrary registered URI-scheme handlers to be invoked on client hosts with no user interaction. For example, one might expect that the carousel content only has https: URIs, not ms-calculator: URIs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Magic: The Gathering Arena represents a critical insecure deserialization and command injection flaw rooted in improper validation of external resources. Specifically, the application fails to sanitize or validate Uniform Resource Identifiers (URIs) supplied by the game server before passing them directly to the Windows shell via Application.OpenURL or ShellExecuteW functions. This architectural decision bypasses standard security controls that typically restrict user agents from launching arbitrary local applications based on untrusted input. The flaw exists within the home-screen carousel feature, where dynamic content is fetched and rendered for users. Because the client trusts the server-supplied URL without verifying its scheme or domain integrity, it creates a direct pathway for an attacker to execute code on the victim's machine if they can compromise or manipulate the content delivery mechanism.
From a technical perspective, this vulnerability allows for arbitrary registered URI-scheme handler invocation with no user interaction required. Modern operating systems associate specific URI schemes, such as http, https, mailto, and custom application-specific protocols like ms-calculator:, with default handlers that launch corresponding applications. By injecting a maliciously crafted URI scheme into the carousel data stream, an attacker can force the client to execute local commands or open sensitive applications without any prompt for user consent. This lack of interaction is particularly dangerous as it eliminates social engineering vectors and ensures immediate execution upon loading the affected screen. The specific example provided highlights how non-standard schemes intended for internal use could be exploited to trigger unintended system behaviors, potentially leading to further exploitation chains depending on the capabilities of the invoked handler.
The operational impact of this vulnerability extends beyond simple application launching. An attacker with control over the carousel content can leverage this flaw to execute arbitrary commands, exfiltrate data through custom protocol handlers that support network transmission, or even facilitate drive-by downloads if certain URI schemes are misconfigured in the target environment. This effectively grants remote code execution capabilities under the context of the currently logged-in user. Given that game clients often run with elevated privileges or have access to sensitive local files and clipboard contents, the potential for data theft or system compromise is significant. The vulnerability undermines the fundamental trust boundary between client-side rendering logic and server-supplied content, treating untrusted input as executable code without sufficient safeguards.
This flaw aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-20 Improvement in Input Validation. It also maps to MITRE ATT&CK techniques involving Command and Scripting Interpreter execution via URI schemes, which is a common method for achieving initial access or lateral movement in Windows environments. The absence of domain validation further exacerbates the risk, as it prevents filtering based on trusted sources, relying solely on scheme validation which may be insufficient if multiple dangerous schemes are registered locally.
Mitigation strategies must focus on implementing strict allow-listing for URI schemes and domains before passing them to shell execution functions. Developers should validate that only expected protocols such as http and https are permitted, rejecting any other scheme types outright. Additionally, domain verification against a list of trusted hosts can prevent redirections to malicious servers even if the scheme is valid. Input sanitization routines must be applied consistently across all user-facing components that handle external links. Updating to patched versions where these validations have been enforced is essential for affected users. Until patches are available, network-level filtering or application whitelisting may provide partial protection by blocking unauthorized outbound connections or preventing execution of untrusted binaries triggered by the URI handlers.