CVE-2026-96425 UBports CVE debrief

Who should care

Defenders and administrators responsible for systems using lomiri-download-manager, especially in environments where untrusted users have local access, should assess exposure and prioritize patching.

Why it matters

CVE-2026-96425 allows arbitrary users to run commands as root over DBus due to an incorrect DBus policy in lomiri-download-manager. Defenders should prioritize patching and restrict local access to untrusted users.

• Verify and apply patches to prevent arbitrary command execution
• Restrict local access to untrusted users to limit exploitation
• Monitor DBus service for suspicious activity to detect potential attacks

Technical summary

The lomiri-download-manager service has an incorrect DBus policy, allowing arbitrary users to run arbitrary commands as root over DBus. This vulnerability has a CVSS score of 5.5 and is considered medium severity. The issue arises from a flawed DBus policy configuration in lomiri-download-manager, which fails to properly restrict access to the service. Defenders should prioritize verifying and applying patches for the lomiri-download-manager service, especially in environments where untrusted users have local access.

Defensive priority

Defenders should prioritize verifying and applying patches for the lomiri-download-manager service, especially in environments where untrusted users have local access.

Recommended defensive actions

• Verify and apply patches for lomiri-download-manager
• Restrict local access to untrusted users
• Monitor DBus service for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry indicate an incorrect DBus policy in lomiri-download-manager allows arbitrary users to run commands as root over DBus. However, details on affected versions, exploitation, and remediation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.