EUVD-2026-36640
GHSA-p464-2mqm-5h37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local access and low-privilege account required to inject journal messages; scope unchanged; only integrity impacted via root-written dump files.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.
AnalysisAI
Content injection in libreport's ABRT post-create event handler grants a low-privileged local user the ability to control file content that the root process writes into crash dump directories. When a monitored process crashes, the event handler script queries the systemd journal for matching log entries and writes the results directly to dump directory files without stripping embedded control characters - allowing an attacker who can write syslog messages to pre-position newline-delimited payloads that corrupt or inject arbitrary lines into those root-owned files. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to local access with low privileges.
Technical ContextAI
libreport is a library and toolset used by ABRT (Automatic Bug Reporting Tool) on Red Hat Enterprise Linux to collect, format, and report crash data. During a crash event, ABRT's post-create hook invokes shell scripts that query the systemd journal using identifiers from the crashed process. CWE-74 (Injection) covers the root cause: the scripts interpolate unsanitized journal output - which a local user can influence by writing crafted syslog entries containing embedded newline characters (\n) - directly into files within the dump directory. Because the dump directory write is performed in a root context, the attacker achieves out-of-band content injection into root-owned files without needing to directly modify those files themselves. Affected CPE strings confirm the scope is Red Hat's packaging of libreport across RHEL 6, 7, and 8 (cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*, cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*, cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*).
RemediationAI
Apply the vendor-issued package update for libreport via standard Red Hat package management (yum/dnf update libreport) once a patched RPM is available; consult https://access.redhat.com/security/cve/CVE-2026-54231 for the specific fixed package version, which was not independently confirmed from the available data. As a compensating control prior to patching, administrators can disable the ABRT service entirely (systemctl disable --now abrt abrtd) to prevent the vulnerable post-create hook from executing; the trade-off is loss of automated crash reporting. Alternatively, restricting local shell access to untrusted users on RHEL systems reduces exposure by denying the attacker the ability to inject syslog messages. Hardening syslog rate-limiting or restricting which processes can write to the journal does not fully mitigate the issue but reduces the attack surface. Note that RHEL 6 is end-of-life and will not receive standard patches; Extended Life Cycle Support contracts or isolation of those hosts is recommended.
More in Red Hat Enterprise Linux 6
View allRemote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces
Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi
Privilege escalation to root and Kerberos-based authentication bypass in SSSD's Active Directory GPO provider affects Re
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today