LeafPad Android EUVD-2026-113172

Exploitation requires local access to the Android device running LeafPad/Leaf Note v1.21 (versionCode 21) - typically another installed app or a second local user able to reach the app's insecurely-permissioned note storage. No authentication and no user interaction are needed once that local foothold exists (CWE-284 improper access control). What LIMITS exploitation: the attacker must already have code execution or an account on the same device, the impact is confined to reading note data (no integrity or availability impact per the description), and the affected product is a single niche note-taking app rather than a broadly deployed service. The input's network attack vector (AV:N) is not supported by the 'insecure permissions' description and should be verified against the advisory.

Signals conflict sharply here. The input CVSS 9.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H) and the SSVC framework (Exploitation: poc, Automatable: yes, Technical Impact: total) plus the 'act_now' decision label all point to high urgency, yet the EPSS probability is only 0.17% (7th percentile) and this is not on the CISA KEV list. Two parts of the CVSS vector appear inconsistent with the described flaw: the description states only that an attacker can READ another user's note data (confidentiality), so the I:H integrity impact is not supported by the evidence, and 'insecure permissions' in an Android app (CWE-284) normally denotes local access by another app or user on the same device rather than a true network vector, so AV:N is questionable and likely should be AV:L - verify with the advisory. Taken together this reads as a genuine confidentiality defect in a specific app but not a widespread-exploitation emergency: the low EPSS, absence from KEV, and the tiny real-world footprint of this hobby F-Droid note app temper the high CVSS. The 'act_now' label and 'Automatable: yes' must be weighed against the fact that an attacker already needs the ability to run code or an app on the victim's device for this local information disclosure.

A malicious or curious app (or a second local user) on the same Android device reaches LeafPad/Leaf Note's insecurely-permissioned note storage and reads notes belonging to another user without authorization. A public PoC reference exists in the F-Droid advisory, but it is not verified as working exploit code. Because the flaw is access-control/permissions based (AC:L, no user interaction), triggering it is straightforward once local access is obtained.