Executive brief
A security flaw in the accountsservice component, which manages user account information on Linux systems, allows a local user to read sensitive system files they should not have access to. By exploiting a weakness in how user profile pictures are handled for accounts managed by systemd-homed, an attacker can trick the system into copying protected files (like password hashes) into a publicly readable location. This could allow a standard user to eventually gain full administrative control of the computer.
Technical details
A vulnerability exists in the systemd-homed code path of accountsservice's SetIconFile D-Bus method. Unlike the 'classic' handler, the 'homed' handler (user_change_icon_file_homed_authorized_cb) fails to drop privileges or validate the user-supplied file path before opening it. Because the accounts-daemon runs as root, it can open any file (including /etc/shadow) and store the contents as the user's avatar. Since these avatars are stored with world-readable permissions, a local unprivileged attacker can disclose sensitive system files, leading to potential privilege escalation. The issue is fixed in version 26.26.9 by ensuring avatar files are read using the calling user's privileges.
Affected products
- freedesktop.org accountsservice 25.34.76 through 26.13.3
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-07-23: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-24: advisory: NVD and Red Hat published advisory details
- 2026-07-24: patched: Fix identified in version 26.26.9