A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade polkitUpgrade polkit-debuginfoUpgrade polkit-docsUpgrade polkit-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade polkit-libsUpgrade polkit-develUpgrade polkitUpgrade polkit-libs-debuginfoUpgrade polkit-docsUpgrade polkit-debuginfoUpgrade polkit-debugsource | Oct 16, 2025 | Jul 11, 2025 |
| Debian | — | No solution exists | Jul 16, 2025 | Jul 14, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade polkit-libsUpgrade polkit | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade polkitUpgrade polkit-libs | Oct 14, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade polkit-libsUpgrade polkit | Sep 15, 2025 | Sep 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade polkitUpgrade polkit-libs | Oct 24, 2025 | Sep 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 11, 2025 |
| Suse | — | Upgrade libpolkit0Upgrade polkitUpgrade libpolkit-gobject-1-0-32bitUpgrade libpolkit-gobject-1-0Upgrade typelib-1_0-polkit-1_0Upgrade libpolkit-agent-1-0-32bitUpgrade polkit-docUpgrade pkexecUpgrade libpolkit-agent-1-0Upgrade polkit-devel | Aug 14, 2025 | Jul 25, 2025 |
| Ubuntu | — | Upgrade policykit-1Upgrade polkitd | Apr 15, 2026 | Jul 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jul 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub