Is CVE-2026-16743 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-16743?

CVE-2026-16743 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-16743

Description

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.