AZL-94088

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94088.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-94088

Upstream

CVE-2026-16743

Published

2026-07-24T13:17:27Z

Modified

2026-09-01T05:26:35Z

Summary

CVE-2026-16743 affecting package accountsservice 23.13.9-1

Details

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-16743

Affected packages

Azure Linux:3 / accountsservice

Package

Name: accountsservice
Purl: pkg:rpm/azure-linux/accountsservice

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

23.13.9-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94088.json"