CVE-2026-85092: Jtsylve Lime

Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days.

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link with the expected filename pointing to any root-owned file, and when the acquisition runs in kernel context, LiME follows the link and truncates the target file with the memory acquisition stream.

Affected products

• Jtsylve Lime: up to and including 1.12.0

Published 2026-09-03. Last modified 2026-09-10.