EUVD-2026-29919
GHSA-wv98-2g94-x84x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryInteract with plasma-login-manager greeter
-
ExploitInvoke over-privileged plasmaloginauthhelper
-
ExecutionTrigger unnecessary-privilege operation
-
PersistExecute actions as root
-
ImpactFull local system compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires an authenticated local user (PR:L) with local access to the machine's login/greeter path - the vulnerable surface is the privileged plasmaloginauthhelper component of plasma-login-manager, which runs with unnecessary elevated privileges (CWE-250). The CVSS 4.0 vector specifies UI:P, so a passive user-interaction element is involved in the login/authentication flow. Limiting factors: it is not remotely exploitable (AV:L), the attacker must already have a local account, the target must be running plasma-login-manager as its display manager (systems using SDDM/GDM are unaffected), and the required interaction plus low-privilege prerequisite constrain opportunistic use to multi-user or physically/remotely-accessible desktop hosts. |
| Impact | The signals are internally consistent and point to a genuine but locally-scoped issue rather than an internet-facing emergency. The CVSS 4.0 base score of 7.0 reflects local attack vector (AV:L), low attacker privileges (PR:L), and required passive user interaction (UI:P), tempered by high impact to all three security properties. EPSS is 0.01% (2nd percentile), and there is no KEV listing and no public exploit identified - so mass or automated exploitation is not indicated. This is a classic privilege-escalation primitive: high value to an attacker who already has a local foothold on a desktop/multi-user Linux system, but low urgency for perimeter-focused triage. Note the UI:P dependency and PR:L requirement meaningfully limit real-world exploitation: the attacker must already be an authenticated local user and some passive user interaction is involved. Precise affected versions are not confirmed from the available data - verify boundaries against the SUSE/openSUSE advisory. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged local account on a shared Linux workstation running plasma-login-manager interacts with the greeter/authentication flow and abuses the over-privileged plasmaloginauthhelper to run actions with the helper's elevated (root) rights, escalating to full system control. Because the CVSS vector is AV:L with PR:L and UI:P, the attack requires local presence and some passive user interaction, not remote access. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Local privilege escalation in KDE's plasma-login-manager arises from its plasmaloginauthhelper component executing with unnecessary elevated privileges (CWE-250), allowing an authenticated local user with a graphical session to obtain full compromise of confidentiality, integrity, and availability. Disclosed via oss-security on 2026-04-27 by SUSE's Matthias Gerstner and tracked as EUVD-2026-29919, the weakness affects the privileged authentication helper backing the login manager. No public exploit identified at time of analysis, and EPSS is very low (0.01%), consistent with a local-only, interaction-dependent flaw rather than a mass-exploitation candidate.
RemediationAI
Apply the distribution-provided update for plasma-login-manager once available; the openSUSE advisory references an upstream bugfix (https://security.opensuse.org/2026/04/27/plasma-login-manager.html#6-upstream-bugfix), so update to the patched package published by your distribution - no vendor-released fixed version string was included in the provided data, so confirm the exact release via that advisory and https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-25710. Patch status: upstream bugfix referenced by the vendor advisory; a specific patched version was not independently confirmed from the input. As compensating controls until patched, restrict local/interactive login on affected hosts to trusted users (this reduces exposure but harms multi-user usability), and on systems where an alternative display manager is acceptable, switch the greeter to SDDM/GDM to avoid the vulnerable plasmaloginauthhelper path (trade-off: reconfiguration and loss of Plasma-specific login integration). Monitor the oss-security thread (https://www.openwall.com/lists/oss-security/2026/04/27) for the confirmed fixed version.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
plasma-login-manager is KDE's Plasma-based display/login manager; plasmaloginauthhelper is the privileged backend helper that performs authentication and session-setup actions on behalf of the unprivileged greeter/UI. The root cause is CWE-250 (Execution with Unnecessary Privileges): the helper runs with more privilege than required (typically root), so weaknesses in how it validates its callers or handles inputs let a low-privileged local user leverage that privilege boundary. Because the CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:L/UI:P with VC/VI/VA all High and no subsequent-system impact (SC/SI/SA:N), the flaw is a contained local escalation on the affected host rather than a remote or lateral-movement vector. Exact affected version boundaries are not enumerated in NVD/EUVD beyond an open-ended range.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local authenticated user (AV:L/PR:L) leverages an over-privileged helper with passive interaction (UI:R) to gain full host compromise (C/I/A:H); scope unchanged as impact stays on the same system.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Executive ViewAI
KDE Plasma's login manager contains a privilege escalation vulnerability allowing authenticated local users to achieve complete system control. This affects organizations deploying KDE Plasma on workstations and desktops, creating risks for data exposure and lateral movement through compromised endpoints. Until patches become available, organizations must implement interim access controls to restrict vulnerability exposure.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim controls: restrict graphical login to necessary authenticated users only; disable graphical login on systems without operational requirements; apply mandatory access controls (SELinux/AppArmor) to restrict plasmaloginauthhelper process privileges; monitor KDE security communications for workarounds or partial fixes; stage alternative login managers (LightDM, GDM, SDDM) for emergency deployment if patch timelines become unacceptable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB