CVE-2026-107058

Publié : 29 octobre 2026

Modifié : 29 octobre 2026

Score CVSS

9.8

CRITICAL

Description détaillée

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://f-droid.org/packages/net.typeblog.shelter/https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md https://github.com/PeterCxy/Shelter https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107058.md

Dernières Vulnérabilités

CVE-2026-9536

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

VOIR DÉTAILS

CVE-2026-9535

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

VOIR DÉTAILS

CVE-2026-8824

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

VOIR DÉTAILS