Critical· 9.8
CVE-2026-36433
A critical code‑execution vulnerability exists in Actions Semiconductor’s Media Player Utilities version 4.46, affecting the Production.dll and RdiskUpgrade.exe components. An attacker with physical access could run arbitrary code on the system. No vendor patch or CISA KEV fix is currently available, so limiting physical access and disabling the vulnerable components are recommended until a fix is released.
publishedSep 9, 2026
last modifiedSep 10, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
40th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 25, 2026
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
01
Who is affected
02
Real-world impact
03
Why this severity
04
What to do about it
no official fix yet
interim mitigations
- ›Restrict physical access to systems running the vulnerable Media Player Utilities.
- ›If the tool is not required, uninstall or disable the Production.dll and RdiskUpgrade.exe components to eliminate the attack surface.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in sources
05
Timeline
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →