CVE-2025-7519
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Risk Assessment
The risk for the organization includes potential system crashes or code execution, but exploitation requires a high-privilege account to place the malicious policy file.
Recommendation
It is recommended to immediately update polkit to the latest patched version and restrict access to policy file placement to trusted administrators only.
Original NVD description (English source)
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.