Yandex vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-25865 Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the High 8.5 · Jun 18, 2026
• CVE-2025-5471 Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.High 7.3 · Dec 9, 2025
• CVE-2025-5470 Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.High 7.3 · Dec 9, 2025
• CVE-2025-5469 Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245High 7.3 · Dec 9, 2025
• CVE-2024-12168 Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.High 8.4 · Jun 2, 2025
• CVE-2023-26226 A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682High 7.4 · May 30, 2025
• CVE-2021-25255 Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.High 8.3 · May 21, 2025
• CVE-2021-25254 Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.High 8.2 · May 21, 2025
• CVE-2024-6473 Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.High 8.4 · Sep 3, 2024
• CVE-2023-29749 An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference filHigh 7.8 · Jun 9, 2023
• CVE-2022-28226 Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYSTEHigh 7.8 · Jun 15, 2022
• CVE-2022-28225 Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEHigh 7.8 · Jun 15, 2022
• CVE-2021-25261 Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTEHigh 7.8 · Jun 15, 2022
• CVE-2021-43305 Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.High 8.8 · Mar 14, 2022
• CVE-2021-43304 Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.High 8.8 · Mar 14, 2022
• CVE-2021-42388 Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.High 8.1 · Mar 14, 2022
• CVE-2021-42387 Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.High 8.1 · Mar 14, 2022
• CVE-2020-27969 Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofingHigh 7.3 · Sep 13, 2021
• CVE-2021-25263 Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEHigh 7.8 · Aug 17, 2021