Security readout for executives and security teams
Plain-English summary
CVE-2026-1464 is a medium-severity integer overflow issue reported in MuntashirAkon AppManager before 4.0.4. The record’s title mentions RawTherapee, but the description and affected product identify AppManager. Successful exploitation appears to require local access and user action, reducing urgency, but affected installations should still be updated.
Executive priority
Treat as routine but time-bound remediation. Prioritize updates where AppManager is used to inspect third-party or untrusted archives. The business risk is lower than internet-facing critical flaws because exploitation requires local conditions and user action.
Technical view
The CVE describes CWE-190 integer overflow or wraparound in AppManager’s tar archive handling, associated with TarUtils.java in org.apache.commons.compress.archivers.tar modules. CVSS 4.0 score is 4.6 with local attack vector, low complexity, no privileges, and active user interaction required. Scope and impact are limited across confidentiality, integrity, and availability.
Likely exposure
Exposure is likely limited to systems or Android devices running MuntashirAkon AppManager versions before 4.0.4, especially where users open or process untrusted archive content. The CVE data does not identify server-side exposure or remote unauthenticated exploitation.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates exploitation requires local access and user interaction. No public exploit details are provided in the supplied sources.
Researcher notes
There is a notable metadata inconsistency: the title references RawTherapee, while the CVE description, affected product, and patch reference point to MuntashirAkon AppManager. Analysis should rely on the affected-product fields unless corrected by the CNA or CVE Program.
Mitigation direction
- Upgrade MuntashirAkon AppManager to version 4.0.4 or later where available.
- Review the referenced upstream pull request for the specific patch context.
- Avoid processing untrusted tar archives in affected AppManager versions.
- Monitor the CVE record and project releases for updated vendor guidance.
Validation and detection
- Inventory AppManager installations and identify versions before 4.0.4.
- Confirm whether the patched release or referenced fix is deployed.
- Check whether users can open untrusted archive files in AppManager workflows.
- Document the CVE title/product discrepancy during vulnerability triage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1464 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
4.6MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/MuntashirAkon/AppManager/pull/1598CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.