CVE-2026-16881

Katalog CVE

CVSS 8.7 · High EPSS 0,44%

Skor CVSS 4.0 8.7 (High) menurut linecorp.com.

Deskripsi (NVD)

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

28 Agustus 2026

Status NVD

Deferred

CVSS 4.0

8.7 (High), sumber linecorp.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://line.github.io/security-advisory-blog/CVE-2026-16881/