TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-3502
• https://trueconf.com/blog/update/trueconf-8-5
• https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502