Systemd CVE-2026-40228

The CVSS score of 2.9 with local attack vector (AV:L), high complexity (AC:H), no privilege requirement (PR:N), and integrity impact only (I:L) reflects limited real-world risk. The local-only attack vector requires an attacker to have shell access to the target system, and the high complexity factor suggests specific conditions (ForwardToWall=yes, active user terminals, emergency-level logger invocation) must align for exploitation. No KEV status or public exploit code has been identified, indicating this is not actively exploited in the wild. The vulnerability enables terminal manipulation for information disclosure or denial of service rather than code execution or privilege escalation. From an SSVC perspective, exploitation is unproven, requires local access and configuration-dependent conditions, and technical impact is limited to terminal display manipulation. This is a low-priority issue suitable for standard patch cycles rather than emergency remediation.

A local attacker with shell access executes logger -p emerg "<ESC>[H<ESC>[2J<ESC>[31mRed Text" on a system with ForwardToWall=yes enabled. The ANSI escape sequences bypass journald's sanitization and are sent to all active user terminals via wall notifications, allowing the attacker to clear screens, inject fake login prompts, or display misleading information to other users for credential harvesting or denial of service. The high complexity factor (AC:H) reflects the requirement that user terminals must be actively listening to wall messages and the ForwardToWall configuration must be explicitly enabled, limiting opportunistic exploitation.