CVE-2026-68928

Name of the Vulnerable Software and Affected Versions Acode versions 1.11.6 through 1.12.6

Description The com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service without a binding permission, and the TerminalService.java file does not verify the caller. This allows any installed Android application to bind to the service and send a MSG EXEC message containing an attacker-controlled cmd value. The terminal implementation then passes this value to ProcessBuilder using sh -c within the Acode User Identifier (UID). Consequently, a local application with zero permissions can execute commands to access Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without user interaction.

Recommendations Update to version 1.12.7.