CVE-2026-4897
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Risk Assessment
A local user can cause system memory exhaustion, potentially leading to system crashes or service unavailability.
Recommendation
Update polkit to a patched version and restrict access to the `polkit-agent-helper-1` binary.
Other vulnerabilities in polkit
See all- CVE-2025-14338High
In Polkit versions before v0.69.0, authentication is disabled by default and a race condition in the authorization check can lead to the same issues as in CVE-2025-66005.
- CVE-2021-3560HighActively exploited
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- CVE-2021-4034HighActively exploited
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
- CVE-2025-7519Medium
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Original NVD description (English source)
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS