Arbitrary File Overwrite in LiME by jtsylve
CVE-2026-85092

5.2MEDIUM

Key Information:

Vendor

Jtsylve

Status
Lime
Vendor
CVE Published:
3 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-85092?

LiME versions up to 1.12.0 contain a vulnerability that allows unprivileged local users to exploit the disk acquisition output path. This issue arises due to inadequate validation of the output path and the failure to use O_NOFOLLOW when handling operator-supplied paths. An attacker controlling the output directory can create a symbolic link with the same filename as expected, pointing to any root-owned file. When the acquisition runs in kernel context, LiME inadvertently follows this symbolic link, leading to the truncation of the target file with the memory acquisition stream.

Affected Version(s)

LiME 0 <= 1.12.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-85092 - Proof of Concept

References

https://gist.github.com/thesmartshadow/5355949144749b431d...
technical-descriptionexploit
https://github.com/jtsylve/LiME/blob/v1.12.0/src/disk.c#L63
technical-description
https://github.com/jtsylve/LiME
product

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Firas (thesmartshadow)
.