Just viewing --not running-- a malicious .desktop or .directory file inside a file browser can run malicious code on a user's system.
A security researcher has published proof-of-concept (PoC) code for a vulnerability in the KDE software framework. A fix is not available at the time of writing.
The bug was discovered by
Dominik "zer0pwn" Penner and impacts the KDE Frameworks package 5.60.0 and below.
The
KDE Frameworks software library is at the base of the KDE desktop environment v4 and v5 (Plasma), currently included with several Linux distributions such as Kubuntu, openSUSE, OpenMandriva, Chakra, KaOS, and others.
