Loading vulnerability…
Configuration Response Injection in Sogou Input Method for Windows
CVE-2026-120422 affects the configuration retrieval mechanism of the SGTool component in Sogou Input Method for Windows. Branded-dictionary promotion configurations are retrieved over unencrypted HTTP, allowing an attacker able to manipulate network traffic or DNS resolution to substitute malicious responses. Attacker-supplied configurations can specify download sources, destination locations, and integrity values, causing arbitrary files to be written into locations used by legitimate application components. Configuration encryption uses an embedded key and initialization vector and does not prevent malicious configuration substitution. Downloaded files can subsequently be executed or loaded through existing application workflows, resulting in arbitrary code execution. SlippyNunchucks exploited this vulnerability to deploy DarkVigil through DLL side-loading.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises endpoint confidentiality and integrity through attacker-controlled file downloads, application-component replacement, and arbitrary code execution. Observed attacks used a legitimate signed executable to side-load DarkVigil, enabling espionage-related plugin execution, data collection, and exfiltration. Existing component-management workflows provided recurring execution opportunities without a separate persistence mechanism. Replacing application components could also cause application failures, although the vulnerability's direct availability impact is rated as none in its supplied CVSS vector.
If you can’t patch tonight, do this now.
Until patched, prevent the affected component from retrieving configurations over unencrypted HTTP where operationally feasible. Protect DNS resolution and monitor for unexpected configuration-request redirection, downloads of executables through promotion workflows, and modification of application components. These controls are compensating measures rather than substitutes for authenticated HTTPS configuration retrieval.
Patch, then assume compromise.
Upgrade Sogou Input Method for Windows to version 16.10 or a later release incorporating the fix. Version 16.10 migrates affected configuration requests to HTTPS and enables certificate pinning. Additional application hardening should validate downloaded file types and restrict destination directories to prevent executable downloads masquerading as images and arbitrary overwrites of application components. Updating alone does not establish that an already compromised endpoint is clean; investigate and remove malicious payloads and restore tampered application components where exploitation is suspected.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.