CVE-2026-107448Published
Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.Op…
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107448 · Microsoft / collected KEV context
cve-program · CVE-2026-107448
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.