CVE-2026-85092
Received Received - Intake

Path Traversal in LiME Memory Acquisition Tool

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85092
EUVD
EUVD-2026-70302

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lime lime to 1.12.0 (inc)
jtsylve lime 1.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LiME through 1.12.0 does not validate the disk acquisition output path and fails to use O_NOFOLLOW when opening the path. This allows unprivileged local users to overwrite root-owned files by creating a symbolic link pointing to any root-owned file. When LiME runs in kernel context, it follows the link and truncates the target file with the memory acquisition stream.

Detection Guidance

Check for unauthorized file modifications or suspicious symbolic links in directories where LiME is used. Review system logs for unexpected file truncation events. Inspect LiME command execution logs for untrusted output paths.

Impact Analysis

An attacker with local access could overwrite critical system files, leading to system instability, data loss, or denial of service. Sensitive data stored in root-owned files could be corrupted or destroyed during memory acquisition.

Compliance Impact

This vulnerability could lead to unauthorized data destruction or corruption, violating integrity requirements in GDPR and HIPAA. It may also result in unauthorized access to sensitive data if root-owned files containing such data are overwritten.

Mitigation Strategies

Update LiME to the latest version if available. Avoid using untrusted paths for LiME output. Use O_NOFOLLOW flags in file operations. Restrict write permissions to directories used by LiME.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85092. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart