A vulnerability was detected in CherryHQ cherry-studio up to 1

CVE-2026-13534 is an improper-authorization flaw in the sha256 function inside src/main/services/memory/MemoryService.ts, part of the CherryIN Preload API in CherryHQ cherry-studio versions 1.9.0 through 1.9.7. By manipulating the state argument, a caller with low privileges can bypass an authorization check guarding the memory service. The exploit is public, but attack complexity is rated *High* and the impact triad is C:L/I:L/A:L — limited disclosure or tampering of stored AI memory entries, not code execution or privilege escalation.

Vendor labeled this MEDIUM (5.0) under CVSS:3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. That label is inflated for the deployment reality. Cherry Studio is an Electron-based *desktop* AI productivity client — there is no multi-tenant server, the 'network' attack vector is the local IPC/preload surface, and the affected feature is being removed entirely in v2. For an enterprise managing 10,000 hosts, this is workstation-class backlog hygiene, not an incident.

Why this verdict

• Desktop, not server: Cherry Studio is an Electron app with no network listener. AV:N describes preload IPC, not internet reachability — empirical exposure population is effectively the count of installed clients with a rendered malicious payload, not a scannable attack surface.
• Impact triad is uniformly Low: C:L/I:L/A:L means partial disclosure or partial tamper of memory entries — no RCE, no SYSTEM, no credential theft primitive, no lateral movement.
• Attack complexity High + PR:L: A foothold inside the renderer is already required. Anyone who has that has easier and more impactful paths (token theft from the same userData dir, for example).
• Role multiplier — none: Cherry Studio occupies the *low-value-role* slot universally. It is not an IdP, hypervisor, EDR, CA, CI/CD node, or backup admin. There is no high-value-role deployment of this product, so the role-multiplier floor does not apply.
• Vendor sunsetting the feature: Memory is slated for removal in v2 — the affected code path has a known short remaining lifespan.

Why not higher?

MEDIUM would require either a credible chain to code execution or a high-value-role deployment of the affected component. Neither exists: impact stays at C:L/I:L/A:L, the product is a single-user desktop client, and no fleet-scale or identity-scale outcome is reachable. Raising to HIGH/CRITICAL would require active exploitation or a backup/identity/hypervisor pivot — none present.

Why not lower?

IGNORE is wrong because a public PoC exists, the vulnerable versions are in active use, and the patch is real. Defenders with Cherry Studio in their software inventory should still move it onto a normal backlog refresh — it just does not warrant emergency action.

1. Upgrade Cherry Studio to the patched release — Pull the post-PR-15413 release from GitHub and push via your endpoint software-management channel (Intune, Jamf, Chocolatey, winget). LOW verdict → no mitigation SLA; align with the noisgate remediation SLA of ≤ 365 days, but bundle into the next normal app-update cycle.
2. Inventory Cherry Studio installs across the fleet — Run an SBOM or software-inventory sweep (Tanium, Intune, osquery apps table on macOS, Get-Package on Windows) to scope how many hosts actually have 1.9.0–1.9.7. Most enterprises will find a long tail in engineering/AI-research teams. Complete the sweep before the 365-day window starts ticking.
3. Disable the Memory feature in policy until upgraded — If your endpoint config management supports app config push, set the memory feature off in user preferences. Removes the vulnerable code path from runtime without uninstalling.
4. Restrict installation of third-party AI assistant plugins/MCP servers — The realistic delivery vehicle is a malicious assistant template or plugin. Constrain plugin sources to a vetted internal allowlist.

Run on each Windows endpoint where Cherry Studio may be installed. Standard user privileges are sufficient. Invoke as .\Check-CVE-2026-13534.ps1. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#requires -Version 5.1
# Check-CVE-2026-13534.ps1
# Detects CherryHQ cherry-studio 1.9.0 - 1.9.7 (vulnerable to CVE-2026-13534)

$ErrorActionPreference = 'SilentlyContinue'

function Get-CherryStudioVersion {
    $candidates = @(
        "$env:LOCALAPPDATA\Programs\cherry-studio\resources\app.asar",
        "$env:LOCALAPPDATA\Programs\cherry-studio\package.json",
        "$env:ProgramFiles\cherry-studio\resources\package.json"
    )
    foreach ($p in $candidates) {
        if (Test-Path $p) {
            $exe = Get-ChildItem "$env:LOCALAPPDATA\Programs\cherry-studio\Cherry Studio.exe" -ErrorAction SilentlyContinue
            if ($exe) { return $exe.VersionInfo.ProductVersion }
        }
    }
    # Fallback: registry uninstall keys
    $keys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    foreach ($k in $keys) {
        $hit = Get-ItemProperty $k | Where-Object { $_.DisplayName -match 'Cherry Studio' }
        if ($hit) { return $hit.DisplayVersion }
    }
    return $null
}

$ver = Get-CherryStudioVersion
if (-not $ver) {
    Write-Output 'UNKNOWN: Cherry Studio not detected on this host'
    exit 2
}

try {
    $sv = [version]($ver -replace '[^\d\.].*$','')
} catch {
    Write-Output "UNKNOWN: could not parse version '$ver'"
    exit 2
}

$min = [version]'1.9.0'
$max = [version]'1.9.7'
if ($sv -ge $min -and $sv -le $max) {
    Write-Output "VULNERABLE: Cherry Studio $ver is in 1.9.0-1.9.7 (CVE-2026-13534)"
    exit 1
} else {
    Write-Output "PATCHED: Cherry Studio $ver is outside 1.9.0-1.9.7"
    exit 0
}

Sources

1. CIRCL Vulnerability-Lookup — CVE-2026-13534
2. CherryHQ cherry-studio GitHub repository
3. CherryHQ cherry-studio Security advisories
4. CherryHQ cherry-studio Releases
5. CherryHQ cherry-studio Issues (tracking #15411)
6. OffSeq Threat Radar — related CherryHQ authorization CVE
7. CWE-285: Improper Authorization
8. FIRST EPSS model