Lomiri Download Manager CVE-2026-96424

Requires local access to a device running the UBports Lomiri/Ubuntu Touch stack with a vulnerable lomiri-download-manager (including the lomiri-upload-manager component) and its DBus service active. The incorrect DBus policy fails to restrict callers, so any non-root local user or app can invoke the privileged DBus method and have the root-owned service read files it should not expose. Limiting factors: exploitation is strictly local (AV:L) and demands the ability to already run code/an app as some user on the device (PR:L); there is no remote or network-facing exposure, and the primitive is confined to reading files the root service can access.

Signals are mixed and skew toward moderate, not top-tier priority. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H (base 7.8 HIGH), but the local attack vector (AV:L) and required low privileges (PR:L) mean the attacker must already have code execution as some user on the Ubuntu Touch device - this is a local privilege-boundary bypass, not a remotely reachable flaw. There is no EPSS score, no CISA KEV listing, and no public POC provided, so this is best treated as 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. A notable internal conflict: the description characterizes the issue strictly as arbitrary file *read* as root (CWE-732, an information-disclosure / confidentiality problem), yet the supplied CVSS vector asserts I:H and A:H - integrity and availability impact that a read primitive alone does not justify; the referenced forum advisory bundles a separate 'arbitrary root command execution' issue, which may explain the inflated I/A metrics being applied to this CVE. Net: a genuine local root-level info-disclosure bug worth patching on affected devices, but the real-world footprint is small and exploitation requires local access, so it is lower operational priority than its 7.8 score implies.

A malicious or compromised unprivileged app running on an Ubuntu Touch device sends a crafted request to the lomiri-upload-manager DBus service, which runs as root. Because the DBus policy is incorrectly scoped, the service honors the request and returns the contents of an arbitrary root-readable file (e.g., credential or configuration files) back to the caller. No public exploit code is identified, but the flaw is trivially reachable once local code execution is held (AV:L, AC:L, PR:L).