CVE-2019-6453

mIRC is an internet chat app, and this bug is about how it handles special “irc://” links that can come from emails or websites. In older versions (before 7.55), a harmful link can trick mIRC into loading a remote configuration file and running unintended actions—like giving an attacker control of what mIRC does on that computer. The risk is largely about whether your staff might click untrusted links and which software is used to open those links.

This matters to you if your business uses mIRC on employee computers and that software is reachable through normal user activity like opening links from email or websites. The exploit relies on how the “irc://” link is handled by the user’s browser/app; the findings note that Chrome is not exploitable. The practical risk is mainly if a crafted “irc://” link can be triggered on an affected mIRC version (before 7.55).

Treat this as important because working proof-of-concept code exists publicly, meaning attackers can test and adapt the technique. The issue is fixed in mIRC 7.55, but until devices are updated, a successful link-based trick could lead to remote command execution on the user’s machine.