accountsservice CVE-2026-61898

Exploitation requires a local user account with write access to their own ~/.pam_environment file (standard on Ubuntu) and the ability to invoke the SetLanguage method on the org.freedesktop.Accounts D-Bus interface (permitted for any authenticated local user session by default on Ubuntu desktop installations). The LANGUAGE entry must be writable before the SetLanguage call is made - the attacker controls timing of both steps. The vulnerability is present only on Ubuntu systems using the Ubuntu-specific accountsservice packaging prior to 23.13.9-8ubuntu7; non-Ubuntu Linux distributions do not ship the affected helper scripts and are not vulnerable. Exploitation is bounded by: local access requirement (no remote vector), necessity of an existing low-privilege user account, and Ubuntu-specific deployment - headless Ubuntu server deployments without D-Bus session access may have a reduced or absent attack surface depending on D-Bus daemon configuration.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated to this vulnerability. The local attack vector (AV:L) correctly limits exposure to users with existing shell access, but the low complexity (AC:L) and low privilege requirement (PR:L) mean that any standard Ubuntu user account is sufficient - no special configuration or elevated starting position is needed beyond a default Ubuntu install with accountsservice running (which covers virtually all Ubuntu desktop deployments). The direct outcome is a root shell, delivering the maximum C:H/I:H/A:H impact triad. EPSS data was not provided in the available intelligence; in its absence, exploitation probability cannot be quantified numerically, but the attack's technical simplicity and detailed public description suggest the barrier to exploitation is low. No CISA KEV listing exists, and no public POC has been identified at time of analysis - these are meaningful signals that exploitation has not yet been observed at scale, but they do not materially reduce urgency given the attack complexity. There are no conflicting signals between the CVSS vector and the textual description: both consistently indicate local access, low privilege, and a direct path to UID 0.

A local user crafts a LANGUAGE value in their ~/.pam_environment file that embeds a GNU sed 'e' flag payload, such as a replacement expression that terminates the expected substitution and appends a shell command (e.g., a reverse shell or SUID binary installation). The attacker then triggers the SetLanguage D-Bus method - which can be done via GNOME Settings by changing the display language, or programmatically via gdbus or a simple D-Bus client. The Ubuntu-specific helper script reads the LANGUAGE entry, interpolates it unsanitized into a sed expression, and GNU sed executes the injected command with the privileges of the helper process running as real UID 0, granting the attacker a root shell. No public POC has been identified, but the mechanism is technically straightforward and the attack requires no race conditions or memory corruption.