CVE-2026-41526: KDE KCoreAddons RCE Vulnerability

CVE-2026-41526 Overview

CVE-2026-41526 is a shell metacharacter handling flaw in KDE KCoreAddons versions before 6.25. The KShell::quoteArgs function is designed to safely quote arguments passed to shell commands. The parsing logic fails to handle metacharacters correctly, allowing an escape from the intended shell quoting context. Any application that relies on this method to sanitize untrusted user input in a security-critical path is affected. The sendInput() function compounds the risk because it transmits strings to a terminal, allowing control characters such as \\x01 to be injected. The flaw is tracked under CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences.

Critical Impact

Attackers with local access can inject shell metacharacters or terminal control characters to execute arbitrary commands through KDE applications that pass user-controlled input to KShell::quoteArgs.

Affected Products

• KDE KCoreAddons versions prior to 6.25
• KDE Frameworks applications consuming KShell::quoteArgs for argument quoting
• Applications using sendInput() to forward user-controlled strings to a terminal

Discovery Timeline

• 2026-04-27 - KDE publishes Security Advisory #20260427-1
• 2026-04-28 - CVE-2026-41526 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-41526

Vulnerability Analysis

KCoreAddons is a foundational KDE Frameworks library providing utility classes used across the KDE ecosystem. The KShell namespace exposes helper functions that prepare strings for shell consumption. KShell::quoteArgs is intended to enclose each argument in quotes so that shell metacharacters lose their special meaning when the string reaches the shell parser.

The implementation does not adequately neutralize every metacharacter the shell or terminal interprets. Specifically, control characters such as \\x01 (Start of Heading) pass through the quoting routine without being escaped or stripped. When the resulting string is delivered to a pseudo-terminal through the sendInput() interface, the terminal layer interprets those control characters before the shell processes the argument. This creates a parser differential between the application's quoting assumptions and the terminal's actual behavior.

The consequence is a command injection primitive. Applications that build command lines from untrusted input — file managers, terminal emulators, IDE integrations, and helper utilities — can be tricked into executing attacker-supplied commands with the privileges of the invoking user.

Root Cause

The root cause is incomplete input neutralization in the quoteArgs parser, referenced in the KCoreAddons kshell.h source. The function treats quoting as sufficient protection without accounting for terminal control sequences that operate below the shell parser. The category aligns with [CWE-150].

Attack Vector

Exploitation requires local access and user interaction, such as opening a crafted file, URI, or document handled by a vulnerable KDE application. The attacker supplies a payload containing terminal control characters embedded in what the target application treats as a normal argument. When the application invokes KShell::quoteArgs and then sends the result through sendInput() to a terminal, the embedded control bytes break out of the quoted context and execute commands chosen by the attacker. No authentication is required to deliver the payload, but a local user session must process it.

No public proof-of-concept exploit code is currently available. See the KDE Security Advisory #20260427-1 for additional technical detail.

Detection Methods for CVE-2026-41526

Indicators of Compromise

• Unexpected child processes spawned by KDE applications such as dolphin, konsole, kate, or krunner that do not match normal user activity
• Shell command lines containing non-printable control characters (bytes in the 0x01–0x1F range outside of normal whitespace)
• KDE applications writing to terminal devices (/dev/pts/*) with payloads containing embedded \\x01 sequences

Detection Strategies

• Audit process execution telemetry for KDE framework processes launching shells (/bin/sh, /bin/bash) with arguments containing escape or control bytes
• Inventory installed KDE Frameworks versions and flag any KCoreAddons build older than 6.25
• Review application logs for invocations of KShell::quoteArgs followed by sendInput() against user-controlled data

Monitoring Recommendations

• Enable Linux auditd rules on execve syscalls originating from KDE GUI processes and inspect argument vectors for control characters
• Forward endpoint process telemetry to a centralized data lake to correlate suspicious child-process chains rooted in KDE binaries
• Track package manager events to confirm KCoreAddons updates land on every Linux endpoint in the fleet

How to Mitigate CVE-2026-41526

Immediate Actions Required

• Upgrade KCoreAddons to version 6.25.0 or later on every Linux endpoint running KDE Plasma or KDE applications
• Apply distribution vendor backports for users on long-term-support releases that do not ship 6.25 directly
• Audit in-house applications that link against KCoreAddons and confirm they consume the patched library

Patch Information

The fix is included in the KCoreAddons v6.25.0 release. Upstream source is maintained at the KDE KCoreAddons repository. Refer to the KDE Security Advisory #20260427-1 for the authoritative remediation guidance.

Workarounds

• Avoid passing untrusted input through KShell::quoteArgs until the patched version is deployed
• Replace sendInput() flows that handle external data with direct execve calls using argument arrays, bypassing shell parsing entirely
• Strip control characters (bytes 0x00–0x1F and 0x7F) from user-supplied strings before invoking any shell-quoting routine

# Verify the installed KCoreAddons version on Debian/Ubuntu
dpkg -l | grep -i kcoreaddons

# Verify on Fedora/RHEL
rpm -q kf6-kcoreaddons kf5-kcoreaddons

# Upgrade via the distribution package manager
sudo apt update && sudo apt install --only-upgrade libkf6coreaddons6
sudo dnf upgrade kf6-kcoreaddons