Webtop Transcoder exploited, converts unintended file types (CVE-2026-111793)

Actively exploited in the wild - CVE-2026-111793 is a medium-severity file type restriction bypass in Openwave Webtop Media Transcoder that lets an authenticated user process and convert document types the administrator explicitly blocked. The flaw is confirmed under CISA KEV, so treat any exposed Transcoder deployment as potentially targeted and apply vendor mitigations now.

Overview

Openwave Webtop Media Transcoder is the conversion service behind the Webtop webmail experience. Administrators rely on its configuration to define which file types may be converted, so that users cannot push unsupported or risky formats through the pipeline. CVE-2026-111793 is a failure to enforce that allowlist.

The CVSS vector is AV:N/AC:L/PR:L/UI:N (score 4.3). An attacker needs only a low-privileged, authenticated account, and no victim interaction is required. The bypass happens when a user interacts with the Transcoder directly rather than through the normal Webmail interface, sidestepping the checks that would otherwise apply. In practice this means the conversion service accepts and processes formats the administrator intended to exclude.

Impact

The immediate consequence is that blocked document types can be converted. That matters because transcoders typically parse complex, untrusted file formats with third-party libraries or custom handlers, and the administrator’s file-type restrictions exist precisely to shrink that attack surface. By ignoring them, an authenticated user can feed the parser input it was never meant to see.

The result can include unintended information disclosure, resource exhaustion on the conversion host, or exposure of weaknesses in format handlers that the allowlist was designed to keep out of reach. The CVSS score of 4.3 is moderate, but the prerequisites are light and the exploit path is confirmed in the wild. EPSS currently puts 30-day exploitation probability at roughly 0.3%, so this is not a mass-scanning event, but KEV listing means real campaigns are using it.

Remediation and mitigation

• Apply the vendor’s fixed Webtop Media Transcoder build as soon as it is available from Openwave. Confirm the version with the vendor advisory before rolling out.
• In the interim, restrict network access to the Transcoder service so only the Webmail front end can reach it, and block direct user connections.
• Audit conversion logs for document types outside the configured allowlist and for requests that bypass the Webmail interface.
• Enforce least privilege on Webtop accounts and review who genuinely needs conversion capability.
• If the Transcoder runs in a container or VM, limit outbound network access and cap CPU and memory to contain abuse of unexpected formats.

Data breach reports are available at breach reports and industry coverage at security news.

Security Insight

This is the second-order kind of bug that allowlists are supposed to prevent: the control exists, is documented, and is simply not applied to every entry point. Transcoder vulnerabilities are especially unforgiving because conversion pipelines sit on top of parsers with long histories of memory-safety bugs, and an allowlist is often the only thing standing between an authenticated user and that surface. For defenders, it reinforces that file-type restrictions must be validated at the service boundary, not just the UI, and that Webtop deployments deserve a review of which conversion paths are genuinely reachable.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs