Cisco Jabber EUVD-2026-94456

Requires a locally installed, co-resident malicious Android app on the same device as Cisco Jabber for Android (com.cisco.im) at a version before 15.3.1.311364; the app needs NO runtime permissions and triggers the flaw by sending a crafted shared content:// URI whose ContentProvider display name embeds '../' traversal sequences to Jabber's EXPORTED crosslaunch.share activity, which uses that unsanitized display name in file-path construction. No user interaction is needed. The limiting factor is the local attack surface: exploitation is impossible remotely - the attacker must already have code execution on the device (an installed app), and the impact is confined to writing files into Jabber's own private directories (databases/, shared_prefs/, no_backup/, files/).

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) scoring 5.1 (Medium) is internally consistent with the description: the attack vector is LOCAL because the attacker must already have a malicious app running on the same Android device, not reachable over a network. The sole impact is VI:L (low integrity) - the ability to write attacker-controlled files into Jabber's private directories - with no confidentiality (VC:N) or availability (VA:N) impact and no scope change (SC/SI/SA:N). Signals are limited: there is no EPSS probability, no CISA KEV listing, and no public POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The main thing elevating practical concern is PR:N/UI:N - a zero-permission app can trigger this with no user interaction, which is unusually low friction for a local attack and a realistic escalation primitive if combined with other flaws. No signals are directly conflicting, but note the barrier: this is only reachable by code already resident on the device, which bounds real-world risk well below what a raw 'path traversal, no permissions, no interaction' summary might imply.

A user installs a seemingly benign, permission-free app that is actually malicious. In the background, that app constructs a shared content:// URI whose ContentProvider display name contains '../' sequences and hands it to Jabber's exported crosslaunch.share activity, causing Jabber to write the attacker-supplied file into its own protected data directory (e.g., databases/ or shared_prefs/) with no user interaction. No public exploit code is referenced in the available data, though VulnCheck has published a technical advisory describing the mechanism.