CVE-2025-7519
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Risk Assessment
The risk for the organization includes potential system crashes or code execution, but exploitation requires a high-privilege account to place the malicious policy file.
Recommendation
It is recommended to immediately update polkit to the latest patched version and restrict access to policy file placement to trusted administrators only.
Other vulnerabilities in polkit
See all- CVE-2025-14338High
In Polkit versions before v0.69.0, authentication is disabled by default and a race condition in the authorization check can lead to the same issues as in CVE-2025-66005.
- CVE-2021-3560HighActively exploited
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- CVE-2021-4034HighActively exploited
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
- CVE-2026-4897Medium
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Original NVD description (English source)
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.