Actively exploited in the wild
Red Hat Libuser Race Condition Vulnerability
Red Hat - Libuser · Listed in the CISA KEV since 2026-08-26. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2015-3246
MediumCVSS 5.1KEVExploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
libuser versions before 0.56.13-8 and 0.60 before 0.60-7 directly modify the /etc/passwd file, allowing local users to cause an error during modification, leading to an inconsistent file state.
Risk Assessment
The organization may experience a denial of service due to file state inconsistency, which can affect user system availability.
Recommendation
It is recommended to update libuser to version 0.56.13-8 or 0.60-7 and monitor the system for unauthorized modifications to the /etc/passwd file.
Original NVD description (English source)
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.