EUVD-2026-36639
GHSA-gvjc-4rfj-mxxj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal account on RHEL host
-
DeliveryTrigger or stage ABRT crash dump
-
ExploitReplace event-script output file with symlink
-
ExecutionRoot post-create script follows symlink
-
PersistArbitrary root-owned file overwritten
-
ImpactEscalate to full system control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires local, low-privileged access (PR:L) to a system running ABRT/libreport with the post-create event handler scripts enabled and processing crashes as root - the default crash-reporting configuration on RHEL 6/7/8. The attacker must be able to write into or influence the crash-dump directory used by ABRT and replace an event-script output file with a symlink before the root shell performs its redirected write, which typically involves winning a timing window. Limiting factors: no network vector (local only), the attacker needs an existing account, abrtd must be running and processing the relevant crash, and disabling or restricting abrtd to trusted users removes the exposure. |
| Impact | Signals are consistent and point to a genuine but not urgent local risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, low-privilege attack with total impact, and SSVC agrees on Technical Impact: total. However, SSVC marks Exploitation: none and Automatable: no, EPSS is only 0.02% (5th percentile), the CVE is not on CISA KEV, and no POC is referenced - so this is a real defense-in-depth priority for multi-user Red Hat hosts, not a mass-exploitation emergency. One caveat to verify: the description frames the primitive as arbitrary file overwrite (integrity/availability), and the Red Hat tag labels it 'Information Disclosure,' yet the vector asserts C:H; confidentiality impact here is indirect, realized through privilege escalation rather than direct data read, so treat C:H as escalation-derived. Exploitation may also involve a timing/race element to swap the file for a symlink, which can raise practical attack complexity beyond the AC:L rating. |
| Exploit ScenarioDerived | A local unprivileged user on a shared RHEL host triggers (or crafts) an application crash that ABRT captures, then replaces an expected output filename in the crash-dump directory with a symlink pointing at a sensitive file such as /etc/shadow, a /etc/cron.d job, or a root-owned config. When the root post-create script redirects its output to that name, it follows the symlink and overwrites the target, letting the attacker corrupt or inject content as root and escalate to full system control. No public exploit code is identified at time of analysis, but the primitive is straightforward for a local attacker who can win the file-replacement timing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
Local privilege escalation via arbitrary root-owned file overwrite affects libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8. The event scripts write output using shell redirections that lack the O_NOFOLLOW flag, so a local low-privileged user who plants a symlink in a writable crash-dump path can cause the root shell to follow it and clobber any file on the system, which can be leveraged for full system compromise. SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 5th percentile).
Earlier versions of this analysis (2)
Local privilege escalation in libreport's ABRT post-create event handler scripts on Red Hat Enterprise Linux 6, 7, and 8 allows a low-privileged local user to overwrite arbitrary root-owned files by planting a symlink where an event script writes its output. Because the scripts use shell redirections lacking the O_NOFOLLOW flag, the root shell follows the attacker-controlled symlink and writes to its target, enabling system file corruption and a likely path to full root compromise. No public exploit identified at time of analysis; EPSS is negligible (0.02%) and CISA SSVC rates exploitation as none, but technical impact is total.
Local privilege escalation via symlink following in libreport's ABRT post-create event handler scripts allows a low-privileged local user to overwrite arbitrary files on Red Hat Enterprise Linux 6, 7, and 8. Because event scripts use shell redirections without O_NOFOLLOW and run as root, swapping an expected output file for a symlink causes root to write attacker-controlled content into the symlink target. No public exploit identified at time of analysis, but the bug pattern is well-understood and reliable when the race is won.
RemediationAI
Apply Red Hat's updated libreport/abrt packages once available for your RHEL 6, 7, or 8 release, tracking the fix through the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-54230) and Bugzilla 2488568 (https://bugzilla.redhat.com/show_bug.cgi?id=2488568); the corrected scripts should open output files with O_NOFOLLOW or otherwise refuse to follow symlinks. No exact fixed package version was provided in the input, so confirm the patched build from the vendor advisory rather than assuming a version. As a compensating control until patched, disable the ABRT processing path or the abrtd service (systemctl disable --now abrtd) so untrusted crash dumps are not processed as root - the trade-off is loss of automatic crash collection and bug reporting. Alternatively, tighten permissions on the crash spool directory (e.g. /var/spool/abrt) and restrict ABRT to trusted users so unprivileged users cannot pre-stage symlinks, accepting reduced crash-reporting coverage for general user processes.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libreport is the reporting library behind ABRT (Automatic Bug Reporting Tool), the default crash-collection and reporting framework on Red Hat and Fedora systems. When a crash is captured, ABRT runs post-create event handler scripts as root to enrich the crash dump directory. These scripts emit data using ordinary POSIX shell output redirection (e.g. '> file'), which opens the destination without O_NOFOLLOW. This is a classic CWE-59 (Link Following / improper link resolution) flaw: because the dump directory is influenced by the unprivileged user whose process crashed, that user can replace an expected output filename with a symlink pointing at a sensitive system file. The privileged shell resolves the symlink and truncates/writes the target. The CPE set scopes exposure to Red Hat Enterprise Linux 6, 7, and 8.
Know when Red Hat Enterprise Linux 6 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv user (AV:L/PR:L); swapping the output file for a symlink requires winning a timing window so AC:H; root file overwrite enables privilege escalation giving C:H/I:H/A:H.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
Executive ViewAI
Red Hat Enterprise Linux 6, 7, and 8 systems running libreport ABRT event handlers are vulnerable to local privilege escalation that can lead to full system compromise through symlink-following flaws in crash-handling scripts. Any organization running RHEL with local user access (SSH, container shells, console access) is at risk of attackers escalating to root and assuming complete system control. Urgent compensating controls are required until Red Hat releases a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Set crash-dump directory permissions to 0700 to block symlink planting; (2) Disable ABRT service if not operationally required; (3) Implement file-integrity monitoring and alerts on crash-dump paths; (4) Restrict local system access to trusted users; (5) Apply SELinux mandatory-access-control policies to ABRT post-create event handlers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Related Vulnerabilities in libreport ABRT Post-Create Event Handler Vulnerabilities
View all 2More in Red Hat Enterprise Linux 6
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Arbitrary code execution in GIMP's PSD import plugin allows an attacker to run code in the context of the user who opens
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
A heap-based buffer overflow in the PNG metadata reader of Eye of GNOME (eog) allows an attacker to potentially achieve
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
Exploit-DB