CVE-2026-64816

The CVSS 6.5 and EPSS 0.00266 scores for this NTLMv2 leak obscure a critical asymmetry: the disclosure emphasizes the community-preset auto-fetch vector, but the user-import vector enables mass credential harvesting with fundamentally different attacker requirements and a dramatically larger victim population. Compromising a software project's community preset repository requires persistence, reconnaissance, and injection into a trusted distribution channel—high-effort, low-yield, and defensible. By contrast, the import vector needs only a Discord post or forum thread with a weaponized .preset file: no infrastructure compromise, no zero-days, no chasing upstream maintainers. An attacker can distribute thousands of credential-harvesting presets across photography communities with near-zero detection risk and plausible deniability ('oops, someone sent me that preset file'). The CVSS calculation deserves scrutiny. NTLMv2 credential theft is routinely rated High or Critical in enterprise threat models because the captured hash enables relay attacks, lateral movement, and in some configurations, immediate authentication to domain resources. The medium rating likely reflects the technical constraints (Windows-only, requires user action) rather than the downstream impact. A single compromised developer workstation in a creative studio or agency could yield domain credentials with access to shared storage, project management tools, or CI/CD pipelines. The EPSS probability estimate almost certainly fails to account for the import vector's attack surface. Community preset auto-fetching is the headline vector but likely represents a small fraction of actual installations—manual preset sharing is the norm in photography communities. The math on 'likely exploited' changes significantly if you model the Discord distribution path, where weaponized presets move through high-trust social networks that treat .preset files as passive assets rather than network-active instructions. What to do: treat all imported preset files as untrusted input. Block UNC paths in any import validation you control. Monitor for SMB callback anomalies from creative tooling. Assume that if this vulnerability is known, weaponized presets are circulating in photography communities—the theoretical risk became a cookbook risk the moment disclosure happened.

Reviewed through automated stages and approved by a human before publication.