CVE-2026-85092: LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running LiME through 1.12.0 are exposed when an unprivileged local user can control the directory used for LiME disk-acquisition output. The issue requires the acquisition to run in kernel context.
What does an attacker need to do to exploit it?
The attacker needs local access and control of the output directory. They create a symbolic link with the filename LiME expects, pointing it at a root-owned file; LiME then follows the link and truncates the target while writing the memory-acquisition stream.
Does exploitation require user interaction or elevated attacker privileges?
The vector is local, and the attacker is described as unprivileged. User interaction is required according to the supplied severity vector, because an acquisition must be run using the attacker-controlled output path.
What is the impact if exploitation succeeds?
An attacker can cause arbitrary root-owned files to be overwritten with the memory-acquisition stream. The provided severity vector indicates high integrity and availability impact, with no confidentiality impact.