CVE-2026-96425: Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Published Oct 16, 2026
·Updated
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
Affected Software
1 affected component
Lomiri lomiri-download-manager
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lomiri-download-managerto a version that resolves this vulnerability.Fixed in 0.3.3 - Upgrade
Upgrade
Ubuntu Touchto a version that resolves this vulnerability.Fixed in 24.04-2.1 - Upgrade
Upgrade
Ubuntu Touchto a version that resolves this vulnerability.Fixed in 24.04-1.5
Event History
Oct 16, 2026
CVE Published
via MITRE·03:35 PM
Data Sourced
via MITRE·03:35 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:22 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A local user with low privileges can exploit the incorrect DBus policy. No user interaction is required.
2
What access does an attacker gain?
The attacker can use DBus to run arbitrary commands as root, resulting in high confidentiality impact.
3
Is this remotely exploitable?
The supplied vector identifies the attack vector as local, so an attacker needs local access to the affected system.