CVE-2026-16743

Name of the Vulnerable Software and Affected Versions accountsservice (affected versions not specified)

Description A flaw exists in accountsservice where the systemd-homed code path for the SetIconFile function opens a user-supplied filename as root. This occurs because the process fails to perform the validation and privilege drop typically executed by the classic handler. Consequently, a local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.