CVE-2019-6453: mIRC URI handler argument injection enables remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.1 with public exploit code and very high EPSS, but exploitation depends on browser-specific URI handling and the CVE is not in KEV.

What it is

mIRC before 7.55 mishandles custom URI protocol handlers, allowing argument injection via an irc:// URI that points to an attacker-controlled .ini file on a UNC share. Because the loaded configuration can direct mIRC to run commands, a crafted link can lead to remote code execution on the victim's host. The flaw matters because it turns a simple URI click into code execution without requiring the attacker to authenticate to the target.

Impact

An attacker can execute arbitrary commands in the context of the mIRC user, and can load a remote configuration file from a UNC path to control mIRC's behavior. This gives full compromise of the user's session and any data or privileges that user holds.

Attack surface

Reached by getting a victim to open a crafted irc:// URI; the CVSS vector shows network reachability with no privileges and no user interaction (AV:N/PR:N/UI:N), though the description notes exploitation depends on browser-specific URI handling and Chrome is not exploitable. No authentication is required on the target side.

Exploitation

Public exploit code and an Exploit-DB entry exist, and EPSS is high (0.54292, 98.9th percentile), but the CVE is not listed in CISA KEV. No ransomware association is documented.

What to do

• Upgrade mIRC to 7.55 or later, which is the fixed release named in the advisory.
• If upgrade is not immediate, remove or restrict the irc:// protocol handler registration so untrusted pages cannot launch mIRC with attacker-controlled arguments.
• Block outbound SMB/UNC access from user workstations to untrusted hosts to prevent loading remote .ini files.
• Restrict or disable loading of mIRC configuration files from network/UNC paths.
• Educate users not to open unsolicited irc:// links, especially from web pages or messages.

Detection

• Monitor process creation for mIRC launched with irc:// arguments or with -i/-r options referencing UNC paths.
• Alert on mIRC or related processes accessing \\host\share paths, particularly .ini files from remote shares.
• Review browser and OS protocol-handler launch events for irc:// invocations originating from web content.
• Hunt for unusual child processes spawned by mIRC shortly after a URI-handler launch.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.