How do I check whether I am affected by CVE-2026-96424?

Check the installed lomiri-download-manager version (for example dpkg -l lomiri-download-manager); 0.3.2 or older is affected. On Ubuntu Touch, a build older than 24.04-2.1 (or 24.04-1.5 on the 1.x line) is affected. Vendor does not give a test command.

What is the fix for CVE-2026-96424?

Update lomiri-download-manager to 0.3.3 or newer (covers lomiri-upload-manager). On Ubuntu Touch, update to 24.04-2.1 or 24.04-1.5. The fix locks the system-bus DBus policy so arbitrary users cannot reach the service.

Who is not affected by CVE-2026-96424?

Not affected if: apparmor-confined-apps-only, patched-0.3.3.

Live › vulnerability › CVE-2026-96424

Go to dashboard

high7.8Infrastructure

Lomiri upload manager: DBus policy lets any user read root files

The system-bus instance of lomiri-upload-manager runs as root, and its DBus policy lets any local user call it. An unconfined local app can make it read any root-readable file and POST the contents to a URL the attacker picks. AppArmor-confined Ubuntu Touch apps cannot reach it.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Any local user reads arbitrary root-owned files over DBus.
CVSS said: 7.8. The facts above agree.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-96424

Go to dashboard

high7.8Infrastructure

Lomiri upload manager: DBus policy lets any user read root files

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 16, 2026 UTC
Last modified: Oct 25, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: local.
Worst case: Any local user reads arbitrary root-owned files over DBus.
CVSS said: 7.8. The facts above agree.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

lomiri-download-manager	linux	>= 0.1.0, <= 0.3.2	0.3.3
ubuntu-touch	linux	<= 24.04-1.4, 24.04-2.0	24.04-1.5, 24.04-2.1

Lomiri upload manager: DBus policy lets any user read root files

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Lomiri upload manager: DBus policy lets any user read root files

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources