CVE-2026-85092: Improper Link Resolution Before File Access ('Link Following') in jtsylve LiME
Description
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.
CVSS v4.0
Score 5.2medium
Affected software
jtsylve
LiME
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85092 describes an improper link resolution vulnerability in jtsylve's LiME software up to version 1.12.0. The vulnerability arises because LiME does not validate the output path for disk acquisition and fails to use the O_NOFOLLOW flag when opening the path parameter supplied by the operator. This allows an unprivileged local attacker who controls the output directory to create a symbolic link with the expected filename that points to any root-owned file. When LiME runs in kernel context, it follows the symbolic link and truncates the target file by writing the memory acquisition stream to it, enabling arbitrary root-owned file overwrite.
Potential Impact
An unprivileged local attacker can overwrite arbitrary root-owned files by exploiting this vulnerability. This can lead to privilege escalation or system compromise if critical system files are overwritten. The vulnerability requires local access and user interaction (UI:P) and has a medium CVSS score of 5.2.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running LiME in environments where untrusted users can control the output directory. Restrict local user permissions to prevent creation of symbolic links in directories used by LiME for output.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-02T23:53:09.796Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a98c85eacd9273b490dcec4
Added to database: 09/03/2026, 01:07:42 UTC
Last enriched: 09/07/2026, 13:09:33 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.