Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

🚨SEVERITY: MEDIUM — CVSS 4.3Security Advisory

TL;DR 📌

  • Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
  • Highest CVSS: 4.3 (Medium).
  • Listed in CISA KEV (2026-11-10) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-111793.

What it is

CVE-2026-111793 affects the Webtop Media Transcoder component within Openwave Messaging Limited’s Webtop platform. The transcoder is responsible for converting documents, and administrators can configure which file types it is permitted to process.

The flaw is a failure to enforce those administrator-defined file-type restrictions. The CVSS vector indicates network access, low attack complexity, low privileges required, and no user interaction — so an authenticated user, without needing to interact with anyone else, can reach the transcoder directly rather than going through the normal Webmail interface. By bypassing the Webmail experience, that user can submit document types the administrator intended to block, and the transcoder will process and convert them anyway.

The impact is limited to integrity-adjacent behaviour: there’s no confidentiality or integrity impact recorded in the vector, but there is a low availability impact, consistent with the transcoder doing work (processing a file type) that it should have refused. This is not a remote-code-execution or data-disclosure bug on its face — it’s a control-bypass that lets an authenticated user get the transcoder to do something policy says it shouldn’t.

CVE-2026-111793 is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-11-10.

What to do

  • Check the advisory for fixed releases; none are listed in the current NVD record, so confirm directly with Openwave Messaging Limited before assuming a patched version exists.
  • Given the KEV listing, treat this as a priority patching item once a fix is available, and track Openwave’s advisory for updates.
  • In the interim, review any network paths that allow authenticated users to reach the Webtop Media Transcoder directly, rather than only through the Webmail front end, and restrict or monitor that access where feasible.
  • Revisit administrator-defined file-type restriction policies — since enforcement is the actual gap, treat server-side allow-lists as currently unreliable and look for compensating controls (e.g. scanning or isolation of converted output) until a fix lands.

For leadership 🧭

Executive summary. Openwave’s Webtop Media Transcoder can be reached directly by any authenticated user, bypassing the file-type restrictions administrators set for Webmail, and the flaw is already listed in CISA’s Known Exploited Vulnerabilities catalogue. There is no vendor-confirmed fix yet, so teams should confirm patch availability with Openwave and restrict direct access to the transcoder in the meantime.

Why it matters:

  • The Webtop Media Transcoder only enforces administrator file-type policy when reached via Webmail; anyone with a direct path to it can submit file types that were explicitly disallowed.
  • Confidentiality and integrity impacts are both recorded as none, but the low availability impact reflects the transcoder doing unauthorised processing it should have refused.
  • The vulnerability is in CISA’s KEV catalogue, added 2026-11-10, meaning it is known to be exploited, even though NVD currently lists no fixed release.
  • The flaw needs only low privileges and no user interaction, so any existing authenticated account - not just an administrator - is enough to trigger the bypass.

Now / Next / Later:

  • Now: Identify and restrict any network path that lets authenticated users reach the Webtop Media Transcoder directly rather than solely through the Webmail interface.
  • Next: Contact Openwave Messaging Limited to confirm whether a patched Webtop Media Transcoder release exists, since none is listed in the current NVD record, and schedule deployment once available.
  • Later: Stop relying on the Webmail front end as the sole enforcement point by adding server-side validation or isolation at the transcoder itself, so file-type restrictions hold regardless of how the service is reached.

Source