CVE-2026-61898
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) in accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted. The value is interpolated unescaped into a sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with AccountsService helper process privileges (real UID 0) via the SetLanguage D-Bus method.
Risk Assessment
A local attacker can gain full root privileges, leading to complete system compromise.
Recommendation
Update accountsservice to version 23.13.9-8ubuntu7 or later, which includes the fix.
Other vulnerabilities in accountsservice
See all- CVE-2026-61897High
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
- CVE-2026-16743Medium
In the accountsservice package, the systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
- CVE-2023-3297High
In Ubuntu's accountsservice, there is a use-after-free vulnerability that can be exploited by an unprivileged local attacker by sending a D-Bus message to the accounts-daemon process.
Original NVD description (English source)
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.