polkit vulnerabilities
6 known CVE vulnerabilities in polkit, translated and rated.
- CVE-2025-14338High
In Polkit versions before v0.69.0, authentication is disabled by default and a race condition in the authorization check can lead to the same issues as in CVE-2025-66005.
- CVE-2021-3560HighActively exploited
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- CVE-2021-4034HighActively exploited
A local privilege escalation vulnerability was found in polkit's pkexec utility. pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
- CVE-2026-85498Low
A flaw was found in polkit where processing input beginning with a null byte triggers an arithmetic error in the authentication agent helper. This causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read that can crash the application and cause a Denial of Service (DoS).
- CVE-2026-4897Medium
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
- CVE-2025-7519Medium
A flaw was found in polkit where an out-of-bounds write can occur when processing an XML policy with 32 or more nested elements. This can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS