EUVD-2026-113176
GHSA-6222-xg8g-pjhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitCraft Intent targeting exported component
-
ExecutionInvoke unguarded component
-
ImpactRead or overwrite application data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Improper export of Android components
|
| Exploitation Conditions | Requires a second app under attacker control to be installed and running on the same device as Tarnhelm v1.8.2 (or local ADB access); the attacking app then sends an Intent to Tarnhelm's exported component, which is exposed without adequate permission or signature guards, to read and overwrite the app's data. Limiting factors: exploitation is local/on-device, not network-reachable despite the published AV:N; it depends on co-resident malicious software and affects only data within Tarnhelm's own sandbox, with no availability impact. No user interaction with Tarnhelm itself is needed once the malicious app is present. |
| Impact | Signals conflict sharply here. The published CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H) paints a critical, remotely exploitable flaw, and the vuln.today Decision label is act_now. However, CWE-926 (improper export of an Android application component) in an Android app distributed via F-Droid is realistically a LOCAL attack surface: an exported component is invoked by another app already present on the same device (or via ADB), not across the network - so the AV:N rating is almost certainly inaccurate and overstates reach; verify the vector with the advisory. Counter-signals reinforce lower real-world urgency: EPSS is only 0.17% (6th percentile) and there is no CISA KEV listing, indicating no observed widespread exploitation. There is no confirmed public exploit, only an advisory reference. Net assessment: a genuine confidentiality/integrity flaw (arbitrary data read and overwrite of the app's data) but constrained to attackers with local code-execution presence on the device, against a niche open-source application - so the act_now label and 9.1 score overstate practical risk relative to the low EPSS, absent KEV, and local-only exploitation model. |
| Exploit ScenarioDerived | A user installs both Tarnhelm v1.8.2 and a malicious or compromised third-party app on the same Android device. The malicious app, requiring no special permissions, sends a crafted Intent to Tarnhelm's improperly exported component, which lacks permission guards, allowing it to read and overwrite Tarnhelm's stored data. No verified public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Exported Android components in Tarnhelm 1.8.2 (versionCode 20250630) lack adequate permission or signature protection, so a malicious app co-installed on the same device - or a local ADB shell - can send crafted Intents to the exposed component and read and overwrite the data held in Tarnhelm's own sandbox. The published CVSS base score is 9.1 with AV:N, but the assessed vector is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N: exploitation is on-device only and requires attacker-controlled software already installed and running alongside Tarnhelm, with no availability impact. No public exploit code has been identified at time of analysis and EPSS is low at 0.17% (6th percentile), although the vuln.today decision label is act_now.
RemediationAI
The available references do not document a vendor patch, a fixed versionCode, or an official workaround for CVE-2026-107027, so no vendor-released patch is identified at time of analysis; verify the installed package cn.ac.lz233.tarnhelm version and check the upstream repository https://github.com/lz233/Tarnhelm and the F-Droid listing https://f-droid.org/packages/cn.ac.lz233.tarnhelm/ for a release newer than versionCode 20250630 that re-declares the affected component as non-exported or protects it with a signature-level permission, and consult the advisory at https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107027.md for updated fix information. Because exploitation requires co-resident attacker-controlled software or a local ADB connection, the practical compensating controls are to treat any device with Tarnhelm 1.8.2 installed as requiring a clean app inventory (removing untrusted or sideloaded packages, which reduces exposure but does not fix the exported component) and to disable USB debugging/ADB and revoke USB authorization on devices where the app is installed (which removes the ADB exploitation path but also blocks legitimate development and debugging workflows). Restricting the app to a dedicated work profile or secondary user reduces cross-app reachability at the cost of separating it from the primary user's data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-926, Improper Export of Android Application Components: an activity, service, content provider or broadcast receiver in the Tarnhelm package (cn.ac.lz233.tarnhelm) is declared exported but is not guarded by a permission, a signature-level protection level, or an explicit caller check. Android inter-process communication via Intents then lets any other application holding the same UID space on the device address that component directly, bypassing the app's own UI and any intent the developer expected. Tarnhelm is an open-source Android utility distributed through F-Droid and its GitHub repository, so the manifest and component declarations are publicly reviewable. The supplied CPE string is a wildcard placeholder (cpe:2.3:a:n/a:n/a), so there is no formal CPE-based version matching and the affected build must be identified by package name and versionCode 20250630. The material discrepancy between the published vector (AV:N, implying network reachability) and the assessed AV:L reflects that the attack surface is Android IPC on a single device; the available sources do not describe the precise Intent action, extras or target component needed to trigger the data read and overwrite, so the trigger mechanics beyond 'invoke an exported component' are not described in the available sources. The tag list includes 'RCE', but nothing in the description, CWE or assessment supports code execution - the confirmed impact is unauthorized read and overwrite of application data within Tarnhelm's sandbox.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
An improperly exported Android component is reached by a co-resident app, so AV:L not AV:N; no privileges or interaction needed (PR:N/UI:N), with high confidentiality and integrity impact and no availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
Executive ViewAI
A critical vulnerability in Tarnhelm 1.8.2 for Android allows a malicious app on the same device to access and modify sensitive data within Tarnhelm's sandbox. This compromises both confidentiality and integrity for users with the app installed, potentially exposing personal information. Leadership should address this promptly due to the high severity and the ease of exploitation once malware is present.
No vendor-released patch identified; interim mitigations include restricting co-installed apps and using Android work profiles to isolate Tarnhelm.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB