CVE-2026-35207 Security feature bypass in dde-control-center
An MITM attacker can bypass TLS verification to intercept avatar downloads, potentially identifying users or injecting malicious images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-35207?
CVE-2026-35207 is a medium-severity vulnerability in linuxdeepin dde-control-center, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a plugin in dde-control-center, which provides the deepinid cloud service. Prior to 6.1.80, plugin-deepinid is configured to skip TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept the traffic, replace the avatar with a malicious or misleading image, and potentially identify the user by the avatar. This vulnerability is fixed in dde-control-center 6.1.80 and 5.9.9.
Weakness: CWE-295
Which versions are affected by CVE-2026-35207?
How do I fix CVE-2026-35207?
No fix has been published for CVE-2026-35207 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35207 being exploited?
There is no known exploitation of CVE-2026-35207 in the wild and no public exploit code.
Sources
Also known as GHSA-jf2h-4vqc-3jgc.