CVE-2026-85092
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.6
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.15%
- CWE
- CWE-59
- Published
- 2026-09-03
- Last modified
- 2026-09-03
Affected products
- jtsylve LiME
Weakness type
Related vulnerabilities
- CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-78622 — Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
- CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
- CVE-2026-69425 — Windows NTFS Tampering Vulnerability
- CVE-2026-69289 — Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83999 — Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2026-70563 — Windows Shell Spoofing Vulnerability
- CVE-2026-69771 — Windows Container Manager Service Security Feature Bypass Vulnerability