CVE-2026-85498
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A flaw was found in polkit where processing input beginning with a null byte triggers an arithmetic error in the authentication agent helper. This causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read that can crash the application and cause a Denial of Service (DoS).
Risk Assessment
An attacker able to supply crafted input could crash the authentication service, disrupting system operation. This may impact the availability of critical services that rely on polkit.
Recommendation
Install the polkit update that fixes the arithmetic error. Until patched, monitor and limit the ability to supply unexpected input to the authentication agent.
Other vulnerabilities in polkit
See all- CVE-2025-14338High
In Polkit versions before v0.69.0, authentication is disabled by default and a race condition in the authorization check can lead to the same issues as in CVE-2025-66005.
- CVE-2021-3560HighActively exploited
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- CVE-2021-4034HighActively exploited
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
- CVE-2026-4897Medium
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
- CVE-2025-7519Medium
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Original NVD description (English source)
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS