Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitra

Summary

Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.

Remediation

1. Inventory every Unknown product deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://f-droid.org/packages/cn.ac.lz233.tarnhelm/
• Referencehttps://github.com/lz233/Tarnhelm
• Referencehttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107027.md