Lomiri Download Manager CVE-2026-96425

Requires the attacker to already possess an unprivileged local account or in-app code execution on a device running lomiri-download-manager (Ubuntu Touch / UBports), and the vulnerable DBus service must be present and active on the system bus as root (its default deployment state). Exploitation is NOT remote: AV:L and the DBus transport mean the attacker must be on the device. Limiting factors: no network vector, so remote attackers cannot reach it without first gaining local access; the flaw is a policy misconfiguration requiring no special non-default setting and no user interaction (UI:N). Patched builds containing the two referenced fix commits close the permissive policy.

This is a local privilege-escalation flaw (CWE-732, incorrect DBus policy) in lomiri-download-manager that lets any unprivileged local user execute arbitrary commands as root via DBus. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.5 Medium) is INTERNALLY INCONSISTENT with the description and the vendor advisory: it scores only confidentiality impact (C:H/I:N/A:N, Scope:Unchanged), which reflects the 'arbitrary file read as root' half of the advisory, but the description and the UBports advisory title explicitly state 'arbitrary root command execution.' Arbitrary command execution as root warrants I:H/A:H and a scope change (S:C), which would raise the real severity to roughly 8.7 (High) - so the published 5.5 materially understates true impact. Mitigating factors are genuine, however: the vector is local (AV:L), so an attacker must already have code-execution/account access on the device, and no EPSS score, KEV listing, or public exploit is present in the input. There is no evidence of active exploitation; the real-world urgency is tempered by the local-only vector and the product's niche (Ubuntu Touch / UBports) footprint. Net: higher technical severity than the 5.5 implies, but low exposure because exploitation requires prior local access to an uncommon platform.

An attacker who has obtained an unprivileged local account or app-level code execution on an Ubuntu Touch device sends a crafted request to the lomiri-download-manager DBus service, whose overly permissive policy fails to restrict callers. The service, running as root, carries out the attacker-supplied command, yielding full root. No public exploit code is referenced, but the fix commits and advisory describe the mechanism precisely; attack complexity is low (AC:L).