CVE-2026-16743: Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
Other sources
A flaw was found in accountsservice. The systemd-homed handler for the SetIconFile D-Bus method (userchangeiconfilehomedauthorizedcb) opens a caller-supplied path as root without the path validation and privilege drop used by the classic handler. A local user with a systemd-homed-managed account can cause accounts-daemon to read arbitrary files (for example /etc/shadow) and store their contents as the user avatar. This issue affects accountsservice versions with homed avatar support (approximately 25.34.76 through 26.13.3) and is fixed in 26.26.9 by reading avatar files as the calling user.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
accountsserviceto a version that resolves this vulnerability.Fixed in 26.26.9Patch accountsservice: arbitrary file read via seticonfile for systemd-homed users
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16743?
The severity of CVE-2026-16743 is categorized as medium with a score of 5.5.
How do I fix CVE-2026-16743?
To fix CVE-2026-16743, ensure that you update the accountsservice to the latest patched version released by your distribution.
What does CVE-2026-16743 affect?
CVE-2026-16743 affects the accountsservice software and specifically the systemd-homed code path for the SetIconFile functionality.
What type of vulnerability is CVE-2026-16743?
CVE-2026-16743 is a vulnerability that allows local attackers to read arbitrary files due to improper handling of user-supplied filenames.
Who is impacted by CVE-2026-16743?
Individuals with systemd-homed-managed accounts can be impacted by CVE-2026-16743 as it allows them to read arbitrary files.