SB2026110240 - Multiple vulnerabilities in Rider

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Certificate Validation (CVE-ID: CVE-2026-118697)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certificate authentication and potentially impersonate a trusted entity.

The vulnerability exists due to improper certificate validation in the jetbrainsd daemon when validating certificates chaining to compromised intermediate certificates. A remote attacker can present a certificate chaining to a compromised intermediate certificate to bypass certificate authentication and potentially impersonate a trusted entity.

2) Improper Check for Certificate Revocation (CVE-ID: CVE-2026-118696)

CWE-ID: CWE-299 - Improper Check for Certificate Revocation

CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass certificate trust checks and potentially impersonate trusted websites.

The vulnerability exists due to improper checking of certificate revocation in the embedded browser when validating certificate chains. A remote attacker can present a certificate chain containing a revoked intermediate certificate to bypass certificate trust checks and potentially impersonate a trusted website.

Remediation

Install update from vendor's website.

References

• https://www.jetbrains.com/privacy-security/issues-fixed/#89f73335687d6e7796983b983a0dca4c
• https://www.jetbrains.com/privacy-security/issues-fixed/#e92142f86d95e93e46d66429fee4a388