CVE-2026-107052

Publié : 29 octobre 2026

Modifié : 29 octobre 2026

Score CVSS

7.5

HIGH

Description détaillée

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Références et Patchs

https://bitbucket.org/projectmaxs/maxs https://f-droid.org/packages/org.projectmaxs.module.fileread/https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107052.md

Dernières Vulnérabilités

CVE-2026-9536

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

VOIR DÉTAILS

CVE-2026-9535

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

VOIR DÉTAILS

CVE-2026-8824

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

VOIR DÉTAILS