CVE-2026-85092— LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following
Quick assessment
Affected
jtsylve LiME
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LiME 1.12.0 及更早版本未能对磁盘采集的输出路径进行充分校验，且在打开操作员提供的路径参数时未使用 标志。这使得非特权本地用户能够覆盖任意由 root 用户拥有的文件。 如果攻击者能够控制输出目录，他们可以创建一个符号链接，该链接使用预期的文件名，并指向任意 root 拥有的文件。当采集过程在内核上下文中运行时，LiME 会跟随该符号链接，从而用内存采集数据流截断（truncates）目标文件。
Possible ATT&CK Techniques 3 AI
T1098 · Account Manipulation T1565 · Data Manipulation T1078.002 · Domain Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85092
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following
Source: CVE Program / CVE List V5
Vulnerability Description
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85092
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85092
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85092 (1)
Proof of Concept for CVE-2026-85092 (1)
-
🔗 GitHub - jtsylve/LiME: LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition. · GitHub Read full article product
Other References for CVE-2026-85092 (1)
IV. Related Vulnerabilities
Same weakness: CWE-59
-
CVE-2026-78409
Util-linux: util-linux: x-mount.subdir detached-tree resolut -
CVE-2024-14047
Improper Link Resolution Before File Access ('Link Following -
CVE-2026-82455
RubyGems before 4.0.13 Path Traversal via Symlink Resolution -
CVE-2026-55108
KubeVela Terraform remote loader DoS via unbounded file read -
CVE-2026-82252
gitoxide before 0.52.1 Repository Boundary Violation via sym
V. Comments for CVE-2026-85092
No comments yet