CVE-2026-96425 Details
Description
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
A vulnerability exists in the Lomiri Download Manager due to an incorrect DBus policy that allows arbitrary users to execute commands as root. This issue affects all Lomiri Download Manager versions up to and including 0.3.2, as well as all Ubuntu Touch versions up to and including 24.04-1.4 and 24.04-2.0. The vulnerability arises because the system bus instances of Lomiri Download Manager can be accessed by any user, enabling the execution of arbitrary commands as root. This flaw can be exploited by unconfined applications on Ubuntu Touch or other distributions with Lomiri, where most applications are likely unconfined.
Users can update to Lomiri Download Manager version 0.3.3 or later. For Ubuntu Touch users, updating to version 24.04-2.1 or 24.04-1.5 is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| UBports lomiri-download-manager | <= 0.3.2 (semver) |
CPE
Remediation
| |
| UBports Ubuntu Touch | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |