LiME up to version 1.12.0 does not validate the directory path used for disk acquisition output, nor does it use the O_NOFOLLOW flag when opening that path. This omission allows a local user who controls the output directory to create a symbolic link named for the expected output file that points to any root‑owned file. When LiME runs in kernel mode, it follows the link and writes its memory capture stream over the target file, effectively truncating it. The result is an arbitrary overwrite of a file owned by root, which could compromise system integrity and allow further escalation. This flaw is a classic instance of symbolic‑link traversal (CWE‑59).

The vulnerability applies to the LiME project by jtsylve, specifically any instance of LiME version 1.12.0 or earlier. Any deployment that installs these versions and uses unprivileged users to initiate disk captures could be affected.

The CVSS score of 5.2 indicates moderate severity. Exploitation requires local access and the ability to create files in the output directory; no remote attack surface or elevated privileges are needed to trigger the overwrite. The EPSS score is not available, and the entry is not listed in CISA’s KEV catalog. Consequently, the risk is confined to environments where unprivileged users can run LiME, but once triggered the impact can be significant due to the ability to erase or tamper with any root‑owned file the link points to. The likely attack vector is local user; a privileged user running the capture would be sufficient, while an attacker needs only normal user privileges to set up the symlink and then invoke the capture process.