CVE-2026-54228
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A TOCTOU race condition was found in the SetElement method of the abrt-dbus D-Bus service. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive.
Risk Assessment
A local user can manipulate crash dump files, potentially hiding attacks or escalating privileges through false data.
Recommendation
Update the abrt package to a patched version and restrict access to the D-Bus service.
Other vulnerabilities in abrt
See all- CVE-2015-5287HighActively exploited
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name.
- CVE-2026-54229High
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. It allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.
- CVE-2011-4088High
ABRT might allow attackers to obtain sensitive information from crash reports.
- CVE-2015-1862High
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Original NVD description (English source)
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.