Ace Scanner CVE-2026-30287

The vulnerability resides in the file import mechanism of ACE Scanner PDF Scanner, a mobile PDF scanning application available on the Google Play Store. The underlying weakness involves insufficient validation or access controls on the file import process, allowing attackers to manipulate file paths or import operations to overwrite system or application-critical files. This arbitrary file overwrite capability (CWE class) can be chained to achieve code execution by overwriting executable files, libraries, or configuration files that the application loads during runtime, or to expose sensitive information by overwriting data files containing credentials or personal information. The mobile application context suggests the attack may require user interaction (such as importing a malicious file) or may exploit insecure default file permissions on the device.