CVE-2025-14338
HighSummary
In Polkit versions before v0.69.0, authentication is disabled by default and a race condition in the authorization check can lead to the same issues as in CVE-2025-66005.
Risk Assessment
The risk is that an unauthenticated user may exploit the race condition to bypass access controls and gain unauthorized privileges, potentially leading to privilege escalation.
Recommendation
It is recommended to immediately upgrade Polkit to version v0.69.0 or later, which includes a fix for the race condition. Also, verify whether the default disabling of authentication is causing issues in your environment.
Other vulnerabilities in Polkit
See all- CVE-2021-4034HighActively exploited
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
- CVE-2026-4897Medium
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
- CVE-2025-7519Medium
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Original NVD description (English source)
Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as in CVE-2025-66005.