The vulnerability in Acode (CVE-2026-68928) arises because the TerminalService is declared as an exported service without binding permission enforcement, and the service does not verify the caller. This allows any installed Android application with no permissions to bind to the service and send a MSG_EXEC message containing an attacker-controlled command. The command is executed via ProcessBuilder with 'sh -c' under Acode's UID, enabling execution of arbitrary commands with Acode's privileges. This can expose private data, remote credentials, Storage Access Framework grants, and runtime permissions. The vulnerability affects versions >=1.11.6 and <1.12.7 and is resolved in version 1.12.7.

An attacker with a zero-permission local Android application can execute arbitrary commands within the security context of Acode, potentially accessing sensitive private data, remote credentials, and granted permissions without user interaction. This elevates the risk of data compromise and unauthorized actions on the device under Acode's privileges.

Upgrade Acode to version 1.12.7 or later, where this vulnerability is fixed by enforcing binding permissions and caller verification on the TerminalService. Until then, avoid installing untrusted applications that could exploit this service.