EUVD-2026-113168
GHSA-pvrj-5wq6-mp8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious app on device
-
ExploitCraft Intent to exported component
-
ExecutionInvoke YAACC exported component without authorization
-
ImpactAccess and control application data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Improper export of Android components
|
| Exploitation Conditions | Requires a separate unauthorized or malicious Android application co-resident on the same device as YAACC versionCode 50200; that app invokes a component YAACC exports (android:exported) without an adequate permission guard or signature check, after which it can access and control YAACC's application data. Limiting factors: the attacker must already have an app running on the victim's device (local presence), and the specific vulnerable build (versionCode 50200) must be installed - this on-device prerequisite constrains realistic exploitation despite the input's AV:N network rating. |
| Impact | The input shows a critical 9.1 CVSS score with vuln.today Decision label 'act_now', yet the supporting signals point to materially lower real-world risk. EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit is identified, so the 'act_now' label and the 9.1 score are not corroborated by exploitation evidence. There is a significant internal inconsistency: the CVSS vector claims AV:N (network) with PR:N/UI:N, but the weakness is CWE-926 (Improper Export of an Android Application Component) in an Android app, and the description says an attacker must 'invoke an exported component' - that is characteristically a local, on-device app-to-app (IPC/Intent) attack, not a remote network one. The AV:N rating therefore likely overstates reach and should be verified against the vendor advisory. Confidentiality and integrity impact (C:H/I:H) on the app's own data is plausible for an unguarded exported component, but availability is correctly N. Net assessment: this is more a high-CVSS, lower-real-risk issue than an active emergency - real exploitation requires a malicious app already present on the same device, exploitation probability is low, and the affected product is a niche app; however, because the source Decision label is 'act_now', maintainers of affected installs should still remediate rather than defer. |
| Exploit ScenarioDerived | A user has YAACC (versionCode 50200) installed alongside a malicious or untrusted Android app. That second app sends an Intent to YAACC's improperly exported component and, without any authorization check, reads or manipulates YAACC's application data. No confirmed working exploit code is available; only advisory references were provided, and the exact trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Insecure component export in Yet Another UPnP Controller (YAACC), build versionCode 50200, lets another application already running on the same Android device invoke a component that YAACC exports without an adequate permission or signature check, giving that app access to and control of YAACC's application data. Anyone running the specific vulnerable build is affected; the attacker must first get a malicious or unauthorized app onto the victim's device. No public exploit code is identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); EPSS is 0.17% (7th percentile), so real-world exploitation pressure is low even though the advisory score is 9.1.
RemediationAI
No fixed versionCode or patched release is listed in the available intelligence, so vendor-released patch status is not confirmed at time of analysis; track the F-Droid package page (https://f-droid.org/packages/de.yaacc/) and the upstream repository (https://github.com/cbejr/yaacc) for a build newer than versionCode 50200, and consult the published advisory at https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107038.md for the maintainer's guidance. Until a fixed build is available, the effective control is to eliminate the attack precondition rather than to reconfigure YAACC: the flaw requires a second, untrusted app co-resident on the same device, so uninstalling YAACC build versionCode 50200 (or avoiding installing it on shared/mobile devices) removes exposure entirely, at the cost of losing UPnP control-point functionality. On managed fleets, restrict installation to F-Droid and disallow unknown-source sideloading through Android Enterprise policy - this narrows but does not eliminate the risk, since any app from an approved store can still invoke the exported component. No in-app setting or configuration flag that restricts access to the exported component is documented in the supplied sources, so such a workaround should not be assumed to exist; if a replacement build is published, updating is the durable fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-926, Improper Export of Android Application Components. In Android, a component (activity, service, receiver or content provider) declared with android:exported="true" is reachable by any other app on the device unless it is additionally protected by an android:permission guard, a signature-level permission, or an explicit caller check. YAACC is an open-source UPnP/DLNA control point distributed through F-Droid as package de.yaacc, with sources at github.com/cbejr/yaacc; versionCode 50200 is the affected build. The reported impact is confidentiality and integrity compromise of the app's own data (CVSS C:H/I:H/A:N) - not availability impact, despite the supplied tag list including the string "RCE". The independently assessed vector is AV:L/AC:L/PR:N/UI:N, i.e. local attack via a co-resident app, whereas the input scored it AV:N; the on-device prerequisite for a second malicious application makes the local rating the accurate one. The supplied CPE string is an unpopulated placeholder (n/a vendor/product/version) and the EUVD affected-version field is likewise n/a, so version precision relies on the F-Droid package and versionCode rather than structured CPE data.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exported Android component is reached via on-device IPC from a co-resident app, so AV:L not AV:N; no privileges or interaction needed; high impact to app data confidentiality and integrity, no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.
Executive ViewAI
CVE-2026-107038 is a critical vulnerability in the YAACC UPnP controller app (build 50200) that allows a malicious app already on an Android device to access and control YAACC's application data. While the attack requires local access and no active exploitation has been observed, the high severity score and lack of a patch mean that any organization with this specific app version installed-whether on corporate or BYOD devices-faces potential data exposure. Leadership should prioritize identifying affected devices and enforcing interim mitigations to prevent data compromise.
No vendor patch is available; implement MDM policies to block installation of YAACC build 50200, restrict app installations to approved sources, and enforce least privilege on device data access. Consider network segmentation to limit lateral movement from compromised devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB