Sogou Input Method up to 16.9 Configuration Retrieval SGTool.exe origin validation

Summaryinfo

A vulnerability classified as critical has been found in Sogou Input Method up to 16.9. The impacted element is an unknown function of the file SGTool.exe of the component Configuration Retrieval. Performing a manipulation results in origin validation. This vulnerability is identified as CVE-2026-120422. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Sogou Input Method up to 16.9. This affects some unknown processing of the file SGTool.exe of the component Configuration Retrieval. The manipulation with an unknown input leads to a origin validation vulnerability. CWE is classifying the issue as CWE-346. The product does not properly verify that the source of data or communication is valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

It is possible to read the advisory at welivesecurity.com. This vulnerability is uniquely identified as CVE-2026-120422 since 11/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 16.10 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Sogou

Name

• Input Method

Version

• 16.0
• 16.1
• 16.2
• 16.3
• 16.4
• 16.5
• 16.6
• 16.7
• 16.8
• 16.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion