CVE-2008-7070: Kvirc

High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days.

Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI. NOTE: this might be due to an incomplete fix for CVE-2007-2951.

Affected products

• Kvirc Kvirc: version 3.4.2 only

Published 2009-08-25. Last modified 2026-06-16.