YAACC (Yet Another UPnP Controller) EUVD-2026-113168

Requires a separate unauthorized or malicious Android application co-resident on the same device as YAACC versionCode 50200; that app invokes a component YAACC exports (android:exported) without an adequate permission guard or signature check, after which it can access and control YAACC's application data. Limiting factors: the attacker must already have an app running on the victim's device (local presence), and the specific vulnerable build (versionCode 50200) must be installed - this on-device prerequisite constrains realistic exploitation despite the input's AV:N network rating.

The input shows a critical 9.1 CVSS score with vuln.today Decision label 'act_now', yet the supporting signals point to materially lower real-world risk. EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit is identified, so the 'act_now' label and the 9.1 score are not corroborated by exploitation evidence. There is a significant internal inconsistency: the CVSS vector claims AV:N (network) with PR:N/UI:N, but the weakness is CWE-926 (Improper Export of an Android Application Component) in an Android app, and the description says an attacker must 'invoke an exported component' - that is characteristically a local, on-device app-to-app (IPC/Intent) attack, not a remote network one. The AV:N rating therefore likely overstates reach and should be verified against the vendor advisory. Confidentiality and integrity impact (C:H/I:H) on the app's own data is plausible for an unguarded exported component, but availability is correctly N. Net assessment: this is more a high-CVSS, lower-real-risk issue than an active emergency - real exploitation requires a malicious app already present on the same device, exploitation probability is low, and the affected product is a niche app; however, because the source Decision label is 'act_now', maintainers of affected installs should still remediate rather than defer.

A user has YAACC (versionCode 50200) installed alongside a malicious or untrusted Android app. That second app sends an Intent to YAACC's improperly exported component and, without any authorization check, reads or manipulates YAACC's application data. No confirmed working exploit code is available; only advisory references were provided, and the exact trigger is not described in the available sources.