Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85092LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

Medium 6.6

In plain English

A medium-severity security flaw in LiME from jtsylve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.

Affected products (as reported)

Vendor	Product	Versions
jtsylve	LiME	0 – through 1.12.0

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

References

Technical report and proof of concept technical-description, exploit
https://github.com/jtsylve/LiME/blob/v1.12.0/src/disk.c#L63 technical-description
https://github.com/jtsylve/LiME product
VulnCheck Advisory: LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following third-party-advisory