The vulnerability identified as CVE-2026-42095 affects KDE Arianna's bookserver component prior to version 26.04.1. It is classified under CWE-306, indicating missing authentication for a critical function. Specifically, attackers can read files by connecting over a socket and guessing URLs, bypassing authentication controls. The CVSS 3.1 base score is 4.0, reflecting a low impact on confidentiality with no impact on integrity or availability. No official patch or remediation level has been published, and no known exploits are reported in the wild.

An attacker with local access can read files through the bookserver by guessing URLs, potentially exposing sensitive information. The impact is limited to confidentiality loss with no effect on integrity or availability. The vulnerability does not require privileges or user interaction, making it easier to exploit in local environments. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the bookserver component to trusted users only and monitor for suspicious local activity. Avoid exposing the vulnerable service to untrusted networks.