libreport EUVD-2026-36640

Exploitation requires: (1) a valid local user account on the affected RHEL 6, 7, or 8 host (PR:L); (2) the ABRT service and libreport post-create event handler must be installed and running, which is the default configuration on RHEL workstation and server installations with the abrt package present; (3) the attacker must be able to write messages to the systemd journal (available to any local user by default via logger or syslog APIs); (4) a process crash must occur on the system after the attacker's journal messages are written - this crash can be any process, not necessarily one the attacker controls. Exploitation is limited by: the requirement for local interactive or programmatic access (AV:L eliminates remote-only attackers); the dependency on a coincident or attacker-triggered process crash to activate the handler; and the absence of a direct privilege escalation path - the impact is integrity manipulation of crash report files, not code execution.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) yields a base score of 5.5, which accurately reflects a locally exploitable integrity issue with no confidentiality or availability impact and no scope change. The High integrity impact (I:H) is the dominant signal: an attacker can manipulate root-written crash reports, potentially poisoning audit evidence or log forensics. Notably, the input tags include 'Denial of Service', which conflicts with A:N in the CVSS vector - this discrepancy is unexplained by available data and should be verified with Red Hat; it may reflect a secondary or theoretical DoS path not captured in the primary vector. No EPSS score was provided, limiting probabilistic exploitation forecasting. The absence of KEV listing and POC means real-world exploitation risk is currently theoretical. The attack complexity is genuinely low once a local foothold exists, but the requirement for a local account and a coincident process crash reduces opportunistic exploitation compared to a purely remote flaw. Overall, this is a moderate-priority issue relevant primarily in multi-tenant or shared-host RHEL environments.

A low-privileged local user on a shared RHEL 7 system crafts a Python script that writes a syslog message containing embedded newline characters designed to look like legitimate crash report fields (e.g., injecting a fake 'executable' or 'backtrace' line). When an application on the same host crashes and ABRT triggers, the post-create event handler queries the journal, captures the attacker's pre-positioned message as part of the output, and root writes the unsanitized content into the crash dump directory - resulting in attacker-controlled lines appearing in root-owned report files. No public POC has been identified, but the technique requires only standard POSIX syslog APIs available to any local user.