CVE catalog

CVE-2025-7519

polkit vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpolicykit-1sid128-1fixed
Debianpolicykit-1forky128-1fixed
Debianpolicykit-1trixie126-2vulnerable
Debianpolicykit-1bookworm122-3vulnerable
Ubuntupolicykit-1nobleNot reportedvulnerable
Ubuntupolicykit-1noble124-2ubuntu1.24.04.3fixed
Ubuntugir1.2-polkit-1.0noble124-2ubuntu1.24.04.3fixed
Ubuntulibpolkit-agent-1-0noble124-2ubuntu1.24.04.3fixed
Ubuntulibpolkit-agent-1-devnoble124-2ubuntu1.24.04.3fixed
Ubuntulibpolkit-gobject-1-0noble124-2ubuntu1.24.04.3fixed
Ubuntulibpolkit-gobject-1-devnoble124-2ubuntu1.24.04.3fixed
Ubuntupkexecnoble124-2ubuntu1.24.04.3fixed
Ubuntupolicykit-1-docnoble124-2ubuntu1.24.04.3fixed
Ubuntupolkitdnoble124-2ubuntu1.24.04.3fixed
Ubuntupolkitd-pklanoble124-2ubuntu1.24.04.3fixed
Cpeopenshift_container_platformNot reportedNot reportedunknown
Cpeenterprise_linuxNot reportedNot reportedunknown
Ubuntupolicykit-122.040.105-31vulnerable
Ubuntupolicykit-122.040.105-31ubuntu1vulnerable
Ubuntupolicykit-122.040.105-31.1vulnerable
Ubuntupolicykit-122.040.105-32vulnerable
Ubuntupolicykit-122.040.105-33vulnerable
Ubuntupolicykit-122.040.105-33ubuntu0.1fixed
Ubuntupolicykit-124.04123-1vulnerable
Ubuntupolicykit-124.04123-3vulnerable
Ubuntupolicykit-124.04124-1vulnerable
Ubuntupolicykit-124.04124-1ubuntu1vulnerable
Ubuntupolicykit-124.04124-2ubuntu1vulnerable
Ubuntupolicykit-124.04124-2ubuntu1.24.04.2vulnerable
Ubuntupolicykit-124.04124-2ubuntu1.24.04.3fixed
Ubuntupolicykit-125.10126-2vulnerable
Ubuntupolicykit-125.10126-2ubuntu0.1fixed
Ubuntupolicykit-1pro0.105-11ubuntu2vulnerable
Ubuntupolicykit-1pro0.105-13vulnerable
Ubuntupolicykit-1pro0.105-13ubuntu1vulnerable
Ubuntupolicykit-1pro0.105-14vulnerable
Ubuntupolicykit-1pro0.105-14.1vulnerable
Ubuntupolicykit-1pro0.105-14.1ubuntu0.1vulnerable
Ubuntupolicykit-1pro0.105-14.1ubuntu0.4vulnerable
Ubuntupolicykit-1pro0.105-14.1ubuntu0.5vulnerable
Ubuntupolicykit-1pro0.105-14.1ubuntu0.5+esm1vulnerable
Ubuntupolicykit-118.040.105-18vulnerable
Ubuntupolicykit-118.040.105-20vulnerable
Ubuntupolicykit-118.040.105-20ubuntu0.18.04.1vulnerable
Ubuntupolicykit-118.040.105-20ubuntu0.18.04.4vulnerable
Ubuntupolicykit-118.040.105-20ubuntu0.18.04.5vulnerable
Ubuntupolicykit-118.040.105-20ubuntu0.18.04.6vulnerable
Ubuntupolicykit-120.040.105-26ubuntu1vulnerable
Ubuntupolicykit-120.040.105-26ubuntu1.1vulnerable
Ubuntupolicykit-120.040.105-26ubuntu1.2vulnerable
Ubuntupolicykit-120.040.105-26ubuntu1.3vulnerable
Ubuntupolicykit-122.040.105-31vulnerable
Ubuntupolicykit-122.040.105-31ubuntu1vulnerable
Ubuntupolicykit-122.040.105-31.1vulnerable
Ubuntupolicykit-122.040.105-32vulnerable
Ubuntupolicykit-122.040.105-33vulnerable
Ubuntupolicykit-122.040.105-33ubuntu0.1fixed
Ubuntupolicykit-124.04123-1vulnerable
Ubuntupolicykit-124.04123-3vulnerable
Ubuntupolicykit-124.04124-1vulnerable
Ubuntupolicykit-124.04124-1ubuntu1vulnerable
Ubuntupolicykit-124.04124-2ubuntu1vulnerable
Ubuntupolicykit-124.04124-2ubuntu1.24.04.2vulnerable
Ubuntupolicykit-124.04124-2ubuntu1.24.04.3fixed
Ubuntupolicykit-125.10126-2vulnerable
Ubuntupolicykit-125.10126-2ubuntu0.1fixed
Opensusepolkittumbleweed127-3.1fixed
Susepolkitlinux micro 6.1121-slfo.1.1_2.1fixed
Susepolkitlinux micro 6.0121-3.1fixed
Susepolkitlinux enterprise server 12 sp5-ltss0.113-5.30.1fixed
Susepolkitlinux enterprise server ltss extended security 12 sp50.113-5.30.1fixed
Susepolkitlinux enterprise micro 5.30.116-150200.3.15.1fixed
Susepolkitlinux enterprise micro 5.40.116-150200.3.15.1fixed
Susepolkitlinux enterprise high performance computing 15 sp3-ltss0.116-150200.3.15.1fixed
Susepolkitlinux enterprise high performance computing 15 sp4-espos0.116-150200.3.15.1fixed
Susepolkitlinux enterprise high performance computing 15 sp4-ltss0.116-150200.3.15.1fixed
Susepolkitlinux enterprise server 15 sp3-ltss0.116-150200.3.15.1fixed
Susepolkitlinux enterprise server 15 sp4-ltss0.116-150200.3.15.1fixed
Susepolkitlinux enterprise server for sap applications 15 sp30.116-150200.3.15.1fixed
Susepolkitlinux enterprise server for sap applications 15 sp40.116-150200.3.15.1fixed
Susepolkitmanager proxy 4.30.116-150200.3.15.1fixed
Susepolkitmanager server 4.30.116-150200.3.15.1fixed
Susepolkitlinux enterprise micro 5.10.116-150200.3.15.1fixed
Susepolkitlinux enterprise micro 5.20.116-150200.3.15.1fixed
Susepolkitenterprise storage 7.10.116-150200.3.15.1fixed
Susepolkitlinux enterprise micro 5.5121-150500.3.6.1fixed
Susepolkitlinux enterprise module for basesystem 15 sp6121-150500.3.6.1fixed
Susepolkitlinux enterprise module for basesystem 15 sp7121-150500.3.6.1fixed
Susepolkitlinux enterprise high performance computing 15 sp5-espos121-150500.3.6.1fixed
Susepolkitlinux enterprise high performance computing 15 sp5-ltss121-150500.3.6.1fixed
Susepolkitlinux enterprise server 15 sp5-ltss121-150500.3.6.1fixed
Susepolkitlinux enterprise server for sap applications 15 sp5121-150500.3.6.1fixed
Opensusepolkitleap 15.6121-150500.3.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpolicykit-1sourcesid127-1unimportantNot reported[1109334]
Debianpolicykit-1sourceforky127-1unimportantNot reported[1109334]
Debianpolicykit-1sourcetrixie(unfixed)unimportantNot reported[1109334]
Debianpolicykit-1sourcebookworm(unfixed)unimportantNot reported[1109334]
Ubuntupolicykit-1debnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntugir1.2-polkit-1.0debnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntulibpolkit-agent-1-0debnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntulibpolkit-agent-1-devdebnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntulibpolkit-gobject-1-0debnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntulibpolkit-gobject-1-devdebnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntupkexecdebnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntupolicykit-1-docdebnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntupolkitddebnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntupolkitd-pkladebnoble124-2ubuntu1.24.04.3Not reportedNot reportedNot reported
Ubuntupolicykit-1deb22.040.105-33ubuntu0.1Not reportedUSN-8173-1Not reported
Ubuntupolicykit-1deb24.04124-2ubuntu1.24.04.3Not reportedUSN-8173-1Not reported
Ubuntupolicykit-1deb25.10126-2ubuntu0.1Not reportedUSN-8173-1Not reported
Ubuntupolicykit-1deb22.040.105-33ubuntu0.1Not reportedUBUNTU-CVE-2025-7519Not reported
Ubuntupolicykit-1deb24.04124-2ubuntu1.24.04.3Not reportedUBUNTU-CVE-2025-7519Not reported
Ubuntupolicykit-1deb25.10126-2ubuntu0.1Not reportedUBUNTU-CVE-2025-7519Not reported
Opensusepolkitrpmtumbleweed127-3.1Not reportedOPENSUSE-SU-2026:10453-1Not reported
Susepolkitrpmlinux micro 6.1121-slfo.1.1_2.1Not reportedSUSE-SU-2025:20662-1Not reported
Susepolkitrpmlinux micro 6.0121-3.1Not reportedSUSE-SU-2025:20559-1Not reported
Susepolkitrpmlinux enterprise server 12 sp5-ltss0.113-5.30.1Not reportedSUSE-SU-2025:02525-1Not reported
Susepolkitrpmlinux enterprise server ltss extended security 12 sp50.113-5.30.1Not reportedSUSE-SU-2025:02525-1Not reported
Susepolkitrpmlinux enterprise micro 5.30.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise micro 5.40.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise high performance computing 15 sp3-ltss0.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise high performance computing 15 sp4-espos0.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise high performance computing 15 sp4-ltss0.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise server 15 sp3-ltss0.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise server 15 sp4-ltss0.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise server for sap applications 15 sp30.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise server for sap applications 15 sp40.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmmanager proxy 4.30.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmmanager server 4.30.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise micro 5.10.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise micro 5.20.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmenterprise storage 7.10.116-150200.3.15.1Not reportedSUSE-SU-2025:02528-1Not reported
Susepolkitrpmlinux enterprise micro 5.5121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Susepolkitrpmlinux enterprise module for basesystem 15 sp6121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Susepolkitrpmlinux enterprise module for basesystem 15 sp7121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Susepolkitrpmlinux enterprise high performance computing 15 sp5-espos121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Susepolkitrpmlinux enterprise high performance computing 15 sp5-ltss121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Susepolkitrpmlinux enterprise server 15 sp5-ltss121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Susepolkitrpmlinux enterprise server for sap applications 15 sp5121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported
Opensusepolkitrpmleap 15.6121-150500.3.6.1Not reportedSUSE-SU-2025:02527-1Not reported

[Debian bug #1109334]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • [pkexec]Affected

    Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • [policykit-1]Affected
    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • [policykit-1-doc]Affected

    Source package: [policykit-1]

    Details (2)
    • 122-3 · all · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · all · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • [polkitd]Affected

    Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

  • [polkitd-pkla]Affected

    Source package: [policykit-1]

    Details (2)
    • 122-3 · amd64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

    • 122-3 · arm64 · bookworm

      Affected

      usn · policykit-1 · debian · bookworm; usn · policykit-1 · debian · 12

[Debian 13 (Trixie)]

  • Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

  • Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

  • Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

  • Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

  • Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

  • [pkexec]Affected

    Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

  • [policykit-1-doc]Affected

    Source package: [policykit-1]

    Details (2)
    • 126-2 · all · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · all · trixie

      Affected

      usn · policykit-1 · debian · 13

  • [polkitd]Affected

    Source package: [policykit-1]

    Details (2)
    • 126-2 · amd64 · trixie

      Affected

      usn · policykit-1 · debian · 13

    • 126-2 · arm64 · trixie

      Affected

      usn · policykit-1 · debian · 13

[openSUSE Tumbleweed]

  • Source package: [polkit]

    Details (1)
    • 127-7.2 · x86_64 · tumbleweed

      Unknown · Fixed: 127-3.1

      Version impact unknown

      usn · polkit · opensuse · tumbleweed

Next results

Observed:

References