CVE-2026-96425
Received Received - Intake

Incorrect DBus Policy in Lomiri Download Manager Allows Root Command Execution

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitLab Inc.

Description
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-96425
EUVD
EUVD-2026-102932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
UBports lomiri-download-manager 0.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect DBus policy in lomiri-download-manager that allows an arbitrary user to execute arbitrary commands with root privileges via DBus. The flaw stems from insufficient restrictions on privileged operations when the application runs with elevated access.

Detection Guidance

Check if lomiri-download-manager is installed and its version with: dpkg -l lomiri-download-manager. If installed, verify the DBus policy configuration for the service using: busctl tree org.freedesktop.DBus | grep lomiri-download-manager. Look for unrestricted root command execution permissions in the service files located at /usr/share/dbus-1/system-services/

Impact Analysis

An attacker could exploit this to run malicious commands as root, potentially taking full control of the system. This could lead to data theft, system compromise, or installation of unauthorized software.

Compliance Impact

This vulnerability allows arbitrary root command execution due to incorrect DBus policy, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized data access or modification.

Mitigation Strategies

Update lomiri-download-manager to the latest version that includes the security fixes from commit 5fd50939. Ensure the application is not running with elevated privileges by checking user permissions and capabilities using system calls like geteuid() and cap_get_proc().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart