CVE-2023-3297
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In Ubuntu's accountsservice, there is a use-after-free vulnerability that can be exploited by an unprivileged local attacker by sending a D-Bus message to the accounts-daemon process.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized code, potentially leading to privilege escalation or system instability.
Recommendation
It is recommended to update the accountsservice to the latest version to mitigate this vulnerability.
Other vulnerabilities in accountsservice
See all- CVE-2026-61898High
Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) in accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted. The value is interpolated unescaped into a sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with AccountsService helper process privileges (real UID 0) via the SetLanguage D-Bus method.
- CVE-2026-61897High
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
- CVE-2026-16743Medium
In the accountsservice package, the systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
Original NVD description (English source)
In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.