KDE KCoreAddons CVE-2026-41526

Exploitation requires that a KDE or third-party application must (1) import and use the vulnerable KShell::quoteArgs() function, (2) pass untrusted or user-controlled input through that function, and (3) execute the resulting string in a shell context (via system(), popen(), or equivalent). The attack is limited to local attackers and requires user interaction - either the user must be tricked into opening a crafted file or triggering specific application functionality that processes malicious input. Non-default configurations are not a prerequisite; any application using KShell::quoteArgs() with user input in a shell execution path is vulnerable. The AC:H (high complexity) suggests the control character injection technique or the specific quoting escape mechanism may require knowledge of the target application's exact use of the function or shell configuration to reliably trigger. Default KDE installations are affected only if applications actively use this function for shell command construction with user input.

The CVSS 6.5 score (AV:L/AC:H/PR:N/UI:R/S:U) indicates local attack vector with high complexity and required user interaction, limiting widespread automated exploitation. However, the local attack vector combined with user interaction requirement suggests this is primarily exploitable in scenarios where an attacker has shell access or can trick a user into opening a crafted file or interacting with a malicious interface. The absence of KEV status and no POC confirmation at analysis time indicates no widespread active exploitation despite public disclosure. The practical risk depends heavily on application context - only applications using KShell::quoteArgs() in security-critical paths to handle untrusted input face real exposure. The moderate CVSS score, local-only attack vector, and required user interaction collectively suggest this is lower priority than remote network vulnerabilities but still requires patching in environments where KDE applications process user-controlled shell command arguments. The high complexity requirement may indicate exploitation requires specific knowledge of the target application's quoting behavior or shell configuration.

An attacker creates a malicious document or configuration file containing specially crafted input with embedded control characters (e.g., \x01) designed to escape shell quoting. A user opens this file with a KDE application that uses KShell::quoteArgs() to process the user-supplied input and pass it to a terminal command via sendInput(). The control character breaks the quoting context, injecting a terminal control sequence that executes an arbitrary command with the user's privileges, such as downloading and running malware or exfiltrating sensitive files.