MAXS Module FileRead CVE-2026-107052

Requires the ProjectMAXS MAXS Module FileRead (versionCode 27) to be installed on the device, plus a second locally-installed app controlled by the attacker that can bind to the module's exported AIDL service, which lacks permission enforcement. The attacker then supplies an absolute path to read files beyond the caller's sandbox. Key limiting factors: this is local IPC exploitation (no remote/network reach despite the input's AV:N), the attacker must already have an app running on the device, and readable content is bounded by the permissions the MAXS module process itself holds rather than full-device access.

The provided CVSS base score is 7.5 (High), but the input vector contains two internal inconsistencies that materially change the real-world picture. First, the vector lists AV:N (network) even though the flaw is in an Android AIDL interface, which is a local inter-process communication mechanism - exploitation requires a malicious app already present on the same device, i.e. local attack vector, not remote network reach. Second, the vector sets C:N/I:H, yet the described impact is arbitrary file READING outside the sandbox, which is a confidentiality breach (should be C:H), not an integrity one; the I:H appears to be a scoring error. No EPSS probability was supplied, the CVE is not listed in CISA KEV, and no public exploit was identified at time of analysis - only a third-party GitHub advisory entry and the vendor repo are referenced. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a locally-exploitable disclosure flaw in a niche product. Net assessment: this is a genuine information-disclosure weakness but not a widespread-exploitation priority - the combination of local-only triggering, a tiny deployment base, and impact bounded by the MAXS module's own granted permissions places it well below the raw 7.5 would suggest. Treat the published AV:N/I:H vector as unreliable and verify with the advisory.

A malicious or low-privilege app installed on an Android device that also runs the ProjectMAXS FileRead module (versionCode 27) binds to the module's improperly-protected AIDL service and passes an absolute filesystem path. Because the interface lacks permission enforcement, the module returns file contents from outside the caller's sandbox, limited to whatever the MAXS module process itself is permitted to read. No public working exploit code was identified; a third-party advisory documents the issue.