Read the docs
TI-2026-14054 Aliases CVE-2026-16881GHSA-86g4-8jpx-6pgq

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.

Priority MEDIUM 46Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed LINE client for Android (LY Corporation): 26.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LY CorporationLINE client for Android—26.7.2Patch availableCNA
  • LINE client for Android VendorLY Corporation Affected — Fixed in 26.7.2 Patch available CNA

Remediation

  • Fix · CNA LINE client for Android (LY Corporation) Fixed in 26.7.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16881
  2. 2026-10-03 Alias added: GHSA-86g4-8jpx-6pgq

References

Other 1

  • TI-2026-10143 Hard-coded credentials in LY Corporation Central Dogma CVSS 4.0CRITICAL 9.4
  • TI-2026-10142 A vulnerability has been identified in centraldogma-server-mirror-git versions prior to… CVSS 4.0HIGH 8.8
  • TI-2026-10145 LDAP injection in LY Corporation Central Dogma CVSS 4.0MEDIUM 6.9
  • TI-2026-10146 A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS… CVSS 4.0CRITICAL 9.1
  • TI-2026-85778 Excessive memory allocation in Armeria from malformed Thrift messages CVSS 4.0HIGH 8.7
  • TI-2026-85777 Path normalization flaw in Armeria lets attackers bypass access controls CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences