CVE-2026-82988 PUBLISHED

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

• https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/
• https://kb.cert.org/vuls/id/234131

• CWE-287 Improper Authentication
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-502 Deserialization of Untrusted Data