CVE-2026-16743 — Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by th…
Published: 2026-07-24 · CVSS: 5.5 · CVSS 3.1
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7