Creative Sound Blaster Katana: Insufficient firmware verification

Summary

A firmware verification flaw in the Creative Sound Blaster Katana V2, V2X and SE soundbars allows an attacker to modify a legitimate firmware image and upload it to the device. Successful exploitation can install malicious firmware and compromise the device. Related public research describes a modified device acting as a keyboard that injects keystrokes into a connected PC, which is a risk for workstations. The attack conditions are not settled: NVD lists an adjacent vector, CSA ties the issue to Bluetooth range, and VulDB says local access is required.

Affected

• Katana V2 (MF8380): versions prior to 1.30.260813.1100
• Katana V2X (MF8400): versions prior to 1.30.260813.1100
• Katana SE (MF8415): versions prior to 1.30.260813.1110 according to CSA; other sources list 1.30.260813.1100 (pending verification with Creative)

Fixed in

• Katana V2 (MF8380): 1.30.260813.1100 or later
• Katana V2X (MF8400): 1.30.260813.1100 or later
• Katana SE (MF8415): 1.30.260813.1110 or later per CSA (pending verification with Creative)

Workaround

• No workaround removes the flaw; a firmware update is the only fix in the sources.
• Partial mitigation for the Bluetooth Low Energy path: turn off Bluetooth where it is not needed (reported as holding the Power and Mode buttons for two seconds; the Creative app then stops working). This does not address firmware uploads over USB; verify on your model.
• Download firmware only from Creative's official support site.

Exploitation

• No evidence of exploitation in the wild; NVD mirror lists KEV: No.
• VulDB states that no public exploit is available for CVE-2026-55981.
• Related research (Pwnd Blaster, published 2026-06-03) describes a similar checksum-only firmware weakness over Bluetooth. It has not been confirmed as the same flaw.

Our recommendation

• Inventory all Katana V2, V2X and SE devices and their firmware versions.
• Update each device to the fixed firmware from Creative's official support site and verify the version afterwards.
• Disable Bluetooth on devices where it is not required.
• Restrict USB devices and avoid connecting unknown or untrusted soundbars to workstations.
• Prioritise devices in shared desks and meeting rooms.
• Re-check the CVE entry once NVD completes its analysis and the SE fixed build is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CSA Singapore AL-2026-134 www.csa.gov.sg
• VulDB CVE-2026-55981 vuldb.com
• VulDB entry 425593 vuldb.com
• Threatint CVE-2026-55981 mirror cve.threatint.com
• NNS blog on Katana BadUSB (June 2026) blog.nns.ee
• Hive Security: Pwnd Blaster Katana V2X research hivesecurity.gitlab.io
• Strix CVE-2026-55981 www.strix.ai
• Creative Singapore: Sound Blaster Katana V2X sg.creative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:08.