CVE-2026-120422 · Sogou Input Method for Windows SGTool.exe insecure HTTP…

01 · The Real Story

An updater that reads its instructions off a public bulletin board and then follows any handwritten addendum to download and run a “package” for you

Sogou Input Method for Windows before 16.10 has a configuration retrieval path in SGTool.exe that fetches configuration over plain HTTP. An attacker who can intercept or spoof that traffic can replace the legitimate config with one that tells SGTool.exe to download attacker-controlled files to arbitrary local paths, including directories later loaded or executed by the application. The result is arbitrary code execution under the privileges of the running component.

There is no vendor/authority CVSS in the official record, so we cannot upgrade or downgrade a baseline; our independent assessment lands at HIGH. VulDB's provisional 6.0–6.3 score understates the endpoint impact because the flaw converts a network-position foothold into code execution without user interaction, and Sogou is widely installed on Windows workstations in Chinese-language environments.

"Sogou's updater trusts unencrypted HTTP — an on-path attacker can turn it into a remote code execution tool. Assessed HIGH."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Establish an on-path network position (Ettercap/Bettercap/MITMf)

The attacker first places themselves between the victim and Sogou's HTTP configuration endpoint. Typical techniques are ARP spoofing on the local LAN, rogue Wi-Fi, DNS poisoning, or control of an upstream router/proxy. Once in path, the attacker can see and modify the next plaintext HTTP request.

Conditions required:

Attacker shares or controls a network segment traversed by the victim's config fetch
Victim runs Sogou Input Method <16.10 on Windows

Where this breaks in practice:

Modern switched/802.1X corporate networks make ARP spoofing harder
Full-tunnel VPN can reduce exposure to local network attackers
Requires becoming a trusted network operator in some enterprise cases

Detection/coverage: ARP spoofing anomalies can be detected by network IDS/NDR; plaintext Sogou HTTP fetches may be visible in proxy logs.

STEP 02

Intercept and replace SGTool.exe config response (mitmproxy as substitution proxy)

When SGTool.exe retrieves its configuration over HTTP, the attacker returns a malicious JSON/XML/config payload instead of the legitimate server response. This step needs no code execution on the target yet — it is a pure network response substitution.

Conditions required:

SGTool.exe must be fetching configuration at that moment or routinely
Attacker knows or can enumerate the config URL and expected response schema

Where this breaks in practice:

Requires reverse-engineering or access to Sogou config format
Application may fetch config only at install/update intervals, not continuously

Detection/coverage: Host-based web inspection can't see HTTPS, but this traffic is HTTP; proxy logs may show unexpected config responses from an IP that is not Sogou.

STEP 03

Instruct SGTool.exe to fetch attacker payload to an arbitrary writable/loadable path (Python HTTP server)

The malicious config points SGTool.exe at an attacker-controlled download URL and a local destination path. Because the component trusts the origin and does not validate that the destination is safe, it writes the downloaded file into a location used by legitimate Sogou components, such as an application directory, %APPDATA% plugin path, or startup folder.

Conditions required:

The SGTool.exe process has write permission for the chosen destination
The destination is subsequently loaded or executed by Sogou or another component

Where this breaks in practice:

Writing into Program Files usually requires elevation
SGTool's normal token may be user-level; if so, only user-writable paths are reachable
EDR may flag unsigned files dropped into unusual per-user app directories

Detection/coverage: EDR/Sysmon can alert on suspicious file creation by SGTool.exe in startup or app directories; file integrity monitoring on install dirs helps.

STEP 04

Trigger execution of dropped file (DLL side-loading or autorun)

Once the malicious file is on disk in a loaded path, the next launch of the application or component loads/executes it. Attackers typically use a renamed DLL that Sogou will side-load, or a .exe/LNK in a startup location. The final impact is arbitrary code execution in the user's session, with the attacker able to run a C2 beacon, keylogger, or credential theft tool.

Conditions required:

Dropped file is a valid PE/DLL in a path Sogou or Windows will load
User or automated service triggers execution/load after the file is placed

Where this breaks in practice:

Application allow-listing or SRP may block unsigned unauthorized binaries
If the file is a DLL, it must match the expected export/load pattern
Endpoint EDR can kill the process or quarantine the dropped artifact

Detection/coverage: EDR behavioral rules should catch unexpected child processes, unsigned DLL loads, or known C2 callbacks; Sysmon Event ID 7/11 are relevant.

03 · Compensating Control

HIGH 7.5→IGNORE 0.0

SEVERITY REDUCED

Upgrade to Sogou Input Method 16.10 immediately — The vendor fix removes the vulnerable config-retrieval path; treat this as the remediation, not a workaround. For HIGH severity, apply within the noisgate remediation SLA of 180 days at minimum, but because this is a single IME update and exploitation tooling is not public, prioritize high-risk users before untrusted network travel.

HIGH 7.5→LOW 2.5

SEVERITY REDUCED

Block HTTP egress to Sogou config/update endpoints — Use endpoint firewall/EDR network containment to deny outbound HTTP from SGTool.exe to non-HTTPS update endpoints as a temporary mitigation. Apply within the noisgate mitigation SLA of 30 days for HIGH. This breaks the config fetch and the malicious download path; it may impact updates/cloud features, so test with a pilot group.

HIGH 7.5→MEDIUM 4.0

SEVERITY REDUCED

Enforce 802.1X and avoid untrusted Wi-Fi for Sogou-backed endpoints — Because the vulnerability is MITM-based, removing shared/guest network exposure reduces the attacker's ability to be on-path. Enforce WPA3/802.1X and endpoint VPN to prevent ARP spoofing. Apply to fleets with Chinese IME installed.

HIGH 7.5→MEDIUM 5.0

SEVERITY REDUCED

Harden Sogou install directories and user-writable component paths — Review ACLs to ensure SGTool.exe cannot write into directories used by trusted components; remove user-modifiable permissions from any Sogou application folder and block execution from %APPDATA%/Temp within your endpoint policy. This limits arbitrary file-write destinations even if the malicious config is accepted.

HIGH 7.5→MEDIUM 4.0

SEVERITY REDUCED

Deploy EDR / application-control rules for SGTool.exe — Create behavioral rules that alert on SGTool.exe spawning unsigned children, writing .dll/.exe files outside its update cache, or making HTTP requests to non-Sogou domains; block unsigned binaries in Sogou's load paths. Apply within 30 days as a compensating control while patch rollouts proceed.

What doesn't work

HTTPS/TLS inspection does not help because the vulnerable channel is already plaintext HTTP and the client won't validate certificates; the attacker doesn't need TLS.
Removing local admin rights alone does not stop the exploit, because SGTool.exe may run with the interactive user's privileges and can still drop files into user-writable load paths.
Relying on current antivirus signatures will likely miss the config-substitution step; the malicious HTTP response is not a traditional malware file until it has already been written.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No confirmed active exploitation; Mallory's `1 exploitation record` is unexplained and likely noise. Not in CISA KEV.
PoC availability	No public PoC/exploit on GitHub or ExploitDB; VulDB says no exploit; cve.tools says no Nuclei/OpenVAS signatures.
EPSS	Unavailable — no EPSS score yet (30-day probability not published).
KEV	Not listed.
CVSS vector	No vendor CVSS; our assessment = `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` = 7.5.
Affected versions	Sogou Input Method for Windows `< 16.10`.
Fixed versions	`16.10` (upgrade); VulDB says upgrade to 16.10.
CWE	`CWE-346` Origin Validation Error / `CWE-345` Insufficient Verification of Data Authenticity.
Disclosure date	2026-11-04; CVE assigned 2026-11-02.
Reporter/CNA	CNA: ESET; advisory referenced on `welivesecurity.com`.
Exposure/scanning	Not externally scannable; requires endpoint inventory (registry/file version check). GreyNoise/Shodan not useful.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.5/10)

Why this verdict

Assessed at HIGH (7.5): arbitrary code execution on a widely deployed Windows input method, no user interaction required beyond the app's normal config fetch.
Network position is the main gate: the attacker must be on-path for plaintext HTTP, but that is achievable with commodity ARP spoofing/rogue Wi-Fi; it is not an unauthenticated remote internet exploit.
Role multiplier: (a) standalone/consumer workstation — chain succeeds, local RCE and keystroke/credential theft; (b) typical enterprise workstation — same plus lateral movement and domain credential exposure; (c) high-value admin/developer workstation — plausible <1% of Sogou's installed base and not a canonical high-value-role component, so the CRITICAL floor is not forced. Endpoint compromise is nevertheless an enterprise-grade risk.
No patchless mitigation blind spot: upstream has a fixed version (16.10) and the bug is not KEV-listed or known to be actively exploited; this keeps it below CRITICAL.

Why not higher?

Not CRITICAL because exploitation requires a privileged network position (on-path) rather than a direct internet-facing attack. There is no public exploitation evidence, no KEV listing, and the affected component is not a hypervisor, IdP, CA, PAM, backup, SIEM, or other canonical high-value-role platform. Without on-path control, the attacker cannot reach the vulnerable HTTP endpoint.

Why not lower?

Not MEDIUM because successful exploitation leads to reliable arbitrary code execution with no user interaction once the config response is replaced, and Sogou Input Method has a very large Windows install base. The HTTP-by-design flaw is silent, and existing endpoint defenses may not inspect or block manipulated plaintext config responses until the malicious file write is already attempted.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows host where Sogou Input Method is installed. Invoke from an elevated PowerShell console for reliable registry/file access: powershell -ExecutionPolicy Bypass -File check_sogou_cve_2026_120422.ps1.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

# check_sogou_cve_2026_120422.ps1
# Checks installed Sogou Input Method version against CVE-2026-120422 fixed version 16.10.
$ErrorActionPreference = 'SilentlyContinue'

function ConvertTo-Version($str) {
    if (-not $str) { return $null }
    $m = [regex]::Match($str, '(\d+\.\d+\.\d+(?:\.\d+)?)')
    if ($m.Success) { return [version]$m.Groups[1].Value }
    return $null
}

$uninstallPaths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$found = $false
$vulnerable = $false
$patched = $false

foreach ($p in $uninstallPaths) {
  Get-ItemProperty $p -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Sogou|搜狗' } |
    ForEach-Object {
      $found = $true
      $ver = ConvertTo-Version $_.DisplayVersion
      if ($ver) {
        if ($ver -lt [version]'16.10') { $vulnerable = $true }
        else { $patched = $true }
      } else {
        $sg = Get-ChildItem 'C:\Program Files*\Sogou*\SGTool.exe','C:\Program Files (x86)\Sogou*\SGTool.exe',"$env:LOCALAPPDATA\Sogou*\SGTool.exe" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($sg) {
          $ver = ConvertTo-Version $sg.VersionInfo.FileVersion
          if ($ver -and $ver -lt [version]'16.10') { $vulnerable = $true }
          elseif ($ver) { $patched = $true }
        }
      }
    }
}

if (-not $found) {
  Write-Output 'UNKNOWN'
  exit 0
}
if ($vulnerable) {
  Write-Output 'VULNERABLE'
  exit 1
}
if ($patched) {
  Write-Output 'PATCHED'
  exit 0
}
Write-Output 'UNKNOWN'
exit 0