Accounts Daemon Local File Read via systemd-homed

Executive Summary

CVE-2026-16743 is a flaw in accountsservice where the systemd-homed code path for SetIconFile opens a user-supplied filename as root without proper validation or privilege dropping. This differs from the classic handler which performs these checks. A local attacker with a systemd-homed-managed account can exploit this to read arbitrary files accessible to the accounts-daemon process.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses accountsservice with systemd-homed integration. Verify the version of accountsservice installed. Look for unusual file reads by accounts-daemon in logs. Commands: rpm -q accountsservice, journalctl -u accounts-daemon, ps aux | grep accounts-daemon

Check for suspicious avatar files in user directories. Look for files modified by accounts-daemon. Commands: find /home -name '*.png' -o -name '*.jpg' -exec ls -la {} \;, ls -la /var/lib/AccountsService/icons/

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to read sensitive files on the system, such as /etc/shadow, by tricking the accounts-daemon into reading them as the user's avatar. This could expose confidential information and potentially lead to further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows local attackers to read arbitrary files accessible to the accounts-daemon process, including sensitive files like /etc/shadow. This could lead to unauthorized access to confidential data, potentially violating GDPR (data protection) and HIPAA (health information privacy) compliance by exposing personal or sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Update accountsservice to version 26.26.9 or later immediately. Disable systemd-homed if not required. Restrict local account access. Monitor accounts-daemon processes for unusual activity.

Useful 0 Not Useful 0