Unscored severity · published Oct 29, 2026
CVE-2026-107027
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and…
New
–
CVSS
–
EPSS
No
On KEV
Description
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107027
f-droid.org
https://f-droid.org/packages/cn.ac.lz233.tarnhelm/
github.com
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107027.md
github.com
https://github.com/lz233/Tarnhelm