Verizon Cloud EUVD-2026-82341

Exploitation requires a malicious application already installed and running on the same Android device as Verizon Cloud (co-resident, AV:L) - there is no remote network path. The malicious app must be able to send ACTION_SEND or ACTION_SEND_MULTIPLE intents to the exported OneTouchUploadActivity or PrintShopCloudActivity components, which are exploitable specifically because they are exported and accept a caller-controlled _display_name that is concatenated unsanitized into the file-staging sink. No user interaction and no elevated privileges are needed. The victim must be signed into an authenticated Verizon Cloud account for the write to reach the cloud account. Limiting factors: requires local device compromise/malicious app installation first, affects only Verizon Cloud versions before 26.7.10, and is confined to integrity impact (arbitrary write) with no data read.

This is a moderate-severity, integrity-only local vulnerability, not a critical remote flaw. The vendor CVSS 4.0 vector (6.9, AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) is internally consistent with the description: exploitation requires a co-resident malicious app already installed on the same Android device (AV:L), but needs no user interaction (UI:N) and no special privileges beyond the ability to send an intent (PR:N). Impact is confined to integrity (VI:H) - arbitrary file write into the staging directory and the victim's authenticated Verizon Cloud account - with no confidentiality or availability impact (VC:N/VA:N), which matches an arbitrary-write-without-read primitive. No EPSS score, KEV status, or explicit POC flag is provided in the input. One reference points to a researcher-controlled GitHub repository (github.com/actuator/com.vcast.mediamanager) that plausibly hosts proof-of-concept material, but this is not confirmed by the input, so it should not be treated as active exploitation. Real-world priority is tempered by the local attack vector: an attacker must first get a malicious app onto the device, which is a meaningful barrier compared to remote unauthenticated flaws. This is a legitimate mobile-app hardening issue worth patching, but it is not a mass-exploitation, drop-everything emergency.

A user installs a malicious or trojanized app alongside the legitimate Verizon Cloud app. The malicious app sends an ACTION_SEND or ACTION_SEND_MULTIPLE intent to the exported OneTouchUploadActivity or PrintShopCloudActivity with a crafted _display_name containing path-traversal sequences, causing attacker-controlled bytes to be written outside the intended staging directory and injected into the victim's authenticated Verizon Cloud account - all without any user interaction. A researcher GitHub repository is referenced and may contain proof-of-concept code, but the input does not explicitly confirm public exploit availability.