AndBible EUVD-2026-113257

Exploitation requires the victim to import/load an attacker-crafted AndBible module zip (a SWORD-style module package) into the app on version identified by versionCode 1111; it is not a service-side remote trigger. The limiting factors are therefore (1) required user interaction - the victim must obtain and install the malicious module file, (2) the need to socially engineer or otherwise deliver that file to the user, and (3) the limited install base of a niche F-Droid Bible app. No authentication to a server is involved. Exact affected version range beyond versionCode 1111 is not specified in the available data, and no configuration toggle is described as required - the flaw appears to lie in how any module zip is processed.

Signals conflict sharply. The input CVSS base score is 9.8 with vector AV:N/AC:L/PR:N/UI:N, which would imply remote, unauthenticated, no-interaction code execution against default configurations. However, the description - 'execute arbitrary code via uploading a crafted module zip' - implies the attacker must get a victim to import/load a malicious SWORD module file, which is a user-interaction-dependent, file-delivery vector rather than a true no-interaction network attack; the UI:N in the supplied vector appears inconsistent with the described trigger and should be verified. EPSS is very low at 0.17% (6th percentile), indicating little evidence of broad opportunistic exploitation, which contrasts with the vuln.today 'act_now' Decision label; because the Decision label is act_now, this should be treated as a prioritized item, but the low EPSS suggests any activity would be targeted/social-engineering-driven rather than widespread. Not listed in CISA KEV. AndBible is a niche open-source Android Bible-study application distributed via F-Droid, so the absolute number of exposed installs is limited. Net: this is a genuinely high-impact (full C/I/A) code-execution flaw that warrants prompt patching per the act_now label, but the realistic blast radius is constrained by required user interaction and the product's small footprint - it is not an internet-wide, self-propagating emergency on the scale the raw 9.8 might suggest.

An attacker builds a malicious AndBible module zip and distributes it through a download link, forum, chat, or sideloaded channel. A user of AndBible (versionCode 1111) imports the crafted module, and the app processes it without adequate validation, resulting in arbitrary code execution in the application's context. A public PoC/advisory reference exists (FFG0d fdroid-android-advisories), but it is not verified as working exploit code; attack complexity is low once the victim loads the file, though delivery depends on convincing the user to import the module.