All vulnerabilities
CVE-2026-104480

Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

Discord libdave
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.40%Chance of exploitation activity in the next 30 days, higher than 32% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.0Also 9686fbaea864aa19f0675e486672b6a77811b6a1CVE List
Published2 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.

Text from CVE List

Affected versions 2

  • libdaveaffected: 1.1.0 before 1.2.0CVE List
  • libdaveaffected: 7b15f1fc16f159da0478aa6be909e38f1e957833 before 9686fbaea864aa19f0675e486672b6a77811b6a1CVE List

References 4