Is CVE-2026-16743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16743 being exploited in the wild.

How severe is CVE-2026-16743?

Medium severity, with a CVSS score of 5.5, published 24 July 2026.

Which products and versions are affected?

Freedesktop.Org AccountsService 25.34.76 through 26.13.3.

Is there a fix for CVE-2026-16743?

A patch was published on 2026-07-24: Fix identified in version 26.26.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16743 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-16743?

Check whether you run Freedesktop.Org AccountsService, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16743: freedesktop.org accountsservice arbitrary file read in SetIconFile

CVE-2026-16743 · Severity: medium · CVSS 5.5 · Published 2026-07-24

A security flaw in the accountsservice component, which manages user account information on Linux systems, allows a local user to read sensitive system files they should not have access to. By exploiting a weakness in how user profile pictures are handled for accounts managed by systemd-homed, an attacker can trick the system into copying protected files (like password hashes) into a publicly readable location. This could allow a standard user to eventually gain full administrative control of the computer.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Freedesktop.Org, Red Hat.

Quick answers

Is CVE-2026-16743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16743 being exploited in the wild.
How severe is CVE-2026-16743?: Medium severity, with a CVSS score of 5.5, published 24 July 2026.
Which products and versions are affected?: Freedesktop.Org AccountsService 25.34.76 through 26.13.3.
Is there a fix for CVE-2026-16743?: A patch was published on 2026-07-24: Fix identified in version 26.26.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16743 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-16743?: Check whether you run Freedesktop.Org AccountsService, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the systemd-homed code path of accountsservice's SetIconFile D-Bus method. Unlike the 'classic' handler, the 'homed' handler (user_change_icon_file_homed_authorized_cb) fails to drop privileges or validate the user-supplied file path before opening it. Because the accounts-daemon runs as root, it can open any file (including /etc/shadow) and store the contents as the user's avatar. Since these avatars are stored with world-readable permissions, a local unprivileged attacker can disclose sensitive system files, leading to potential privilege escalation. The issue is fixed in version 26.26.9 by ensuring avatar files are read using the calling user's privileges.

Affected products

freedesktop.org accountsservice 25.34.76 through 26.13.3
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10

Timeline

2026-07-23: disclosed: Initial report in Red Hat Bugzilla
2026-07-24: advisory: NVD and Red Hat published advisory details
2026-07-24: patched: Fix identified in version 26.26.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.