Security readout for executives and security teams
Plain-English summary
CVE-2026-47114 lets a malicious website or link abuse IINA's macOS URL handler to run commands as the logged-in user. The user must approve the browser's protocol prompt, but a real media file is not required. IINA versions before 1.4.3 are in scope.
Executive priority
Prioritize patching managed macOS endpoints that have IINA installed. The issue is user-assisted, but successful exploitation could run commands with the user's privileges, creating meaningful data theft and workstation compromise risk.
Technical view
IINA before 1.4.3 passed unvalidated mpv_-prefixed iina://open query parameters into mpv runtime options/input commands. This creates user-assisted command execution with network delivery, no authentication, and high impact to confidentiality, integrity, and availability. The cited patch and release tag identify 1.4.3 as the fixed version.
Likely exposure
Exposure is most likely on macOS workstations where IINA before 1.4.3 is installed and registered to handle iina:// URLs. Risk increases for users who browse the web, receive external links, or use IINA as a default media player.
Exploitation context
The source bundle includes a public technical write-up tagged as exploit and a third-party advisory. The bundle does not show CISA KEV listing or other evidence of active exploitation. Treat this as publicly documented and practical, but not confirmed exploited in the wild from the provided evidence.
Researcher notes
Focus validation on URL scheme registration, pre-1.4.3 builds, and handling of mpv_-prefixed query parameters. Do not assume active exploitation from the bundle. The affected-product data is sparse, so rely on the description, release notes, and patch reference for version scoping.
Mitigation direction
- Upgrade IINA to version 1.4.3 or later.
- Inventory macOS endpoints for IINA versions older than 1.4.3.
- Warn users not to approve unexpected browser prompts for iina:// links.
- Check vendor release notes and advisory updates for additional hardening guidance.
- Consider restricting custom URL scheme handling until patched, where endpoint controls support it.
Validation and detection
- Verify installed IINA versions report 1.4.3 or later.
- Confirm endpoint inventory has no IINA versions older than 1.4.3.
- Review browser and endpoint telemetry for unexpected iina://open invocations.
- Validate that software management tools deploy the fixed release to macOS fleets.
- Track the CVE record and vendor release page for updated scope or fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-88: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-47114 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://binary.stackpointer.re/iina-142-url-scheme-command-executionCVE reference, VulnCheck · technical-description, exploit
- https://github.com/iina/iina/releases/tag/v1.4.3CVE reference, VulnCheck · release-notes
- https://github.com/iina/iina/commit/1e6f43248dab9d6ae303781c790e5315cbc9fcefCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/iina-command-execution-via-iina-open-url-schemeCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.