EUVD-2026-36640
GHSA-p464-2mqm-5h37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local access and low-privilege account required to inject journal messages; scope unchanged; only integrity impacted via root-written dump files.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.
AnalysisAI
Content injection in libreport's ABRT post-create event handler grants a low-privileged local user the ability to control file content that the root process writes into crash dump directories. When a monitored process crashes, the event handler script queries the systemd journal for matching log entries and writes the results directly to dump directory files without stripping embedded control characters - allowing an attacker who can write syslog messages to pre-position newline-delimited payloads that corrupt or inject arbitrary lines into those root-owned files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid local user account on the affected RHEL 6, 7, or 8 host (PR:L); (2) the ABRT service and libreport post-create event handler must be installed and running, which is the default configuration on RHEL workstation and server installations with the abrt package present; (3) the attacker must be able to write messages to the systemd journal (available to any local user by default via logger or syslog APIs); (4) a process crash must occur on the system after the attacker's journal messages are written - this crash can be any process, not necessarily one the attacker controls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) yields a base score of 5.5, which accurately reflects a locally exploitable integrity issue with no confidentiality or availability impact and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user on a shared RHEL 7 system crafts a Python script that writes a syslog message containing embedded newline characters designed to look like legitimate crash report fields (e.g., injecting a fake 'executable' or 'backtrace' line). When an application on the same host crashes and ABRT triggers, the post-create event handler queries the journal, captures the attacker's pre-positioned message as part of the output, and root writes the unsanitized content into the crash dump directory - resulting in attacker-controlled lines appearing in root-owned report files. … |
| Remediation | Apply the vendor-issued package update for libreport via standard Red Hat package management (yum/dnf update libreport) once a patched RPM is available; consult https://access.redhat.com/security/cve/CVE-2026-54231 for the specific fixed package version, which was not independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows any unprivilege
Remote denial of service in 389 Directory Server (Red Hat Directory Server 11/12/13 and Red Hat Enterprise Linux 6 throu
Local privilege escalation via symlink following in libreport's ABRT post-create event handler scripts allows a low-priv
Local privilege escalation in the abrt-dbus D-Bus service on Red Hat Enterprise Linux 6, 7, and 8 allows a low-privilege
Out-of-bounds heap write in QEMU's virtio-blk device allows a high-privileged guest to crash the host QEMU process. The
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today