CVE catalog

CVE-2026-57223

UBUNTU-CVE-2026-57223

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansuricata131:7.0.10-1vulnerable
Debiansuricata131:7.0.10-1+deb13u1vulnerable
Debiansuricata131:7.0.10-1+deb13u2vulnerable
Debiansuricata131:7.0.10-1+deb13u3vulnerable
Debiansuricata131:7.0.10-1+deb13u4vulnerable
Debiansuricata131:7.0.11-1vulnerable
Debiansuricata131:7.0.11-1~bpo13+1vulnerable
Debiansuricata131:8.0.0-1~exp1vulnerable
Debiansuricata131:8.0.0-1~exp2vulnerable
Debiansuricata131:8.0.0-1~exp4vulnerable
Debiansuricata131:8.0.0-1~exp5vulnerable
Debiansuricata131:8.0.1-1vulnerable
Debiansuricata131:8.0.1-2vulnerable
Debiansuricata131:8.0.1-3vulnerable
Debiansuricata131:8.0.1-3~bpo13+1vulnerable
Debiansuricata131:8.0.2-1vulnerable
Debiansuricata131:8.0.2-1~bpo13+1vulnerable
Debiansuricata131:8.0.3-1vulnerable
Debiansuricata131:8.0.3-1~bpo13+1vulnerable
Debiansuricata131:8.0.3-2~exp1vulnerable
Debiansuricata131:8.0.4-1vulnerable
Debiansuricata131:8.0.4-1~bpo13+1vulnerable
Debiansuricata131:8.0.5-1vulnerable
Debiansuricata131:8.0.5-1~bpo13+1vulnerable
Debiansuricata131:8.0.6-1vulnerable
Debiansuricata131:8.0.6-1~bpo13+1vulnerable
Debiansuricata131:8.0.7-1vulnerable
Debiansuricata131:8.0.7-1~bpo13+1vulnerable
Debiansuricata131:8.0.7-2~exp1vulnerable
Debiansuricata141:7.0.10-1vulnerable
Debiansuricata141:7.0.11-1vulnerable
Debiansuricata141:7.0.11-1~bpo13+1vulnerable
Debiansuricata141:8.0.0-1~exp1vulnerable
Debiansuricata141:8.0.0-1~exp2vulnerable
Debiansuricata141:8.0.0-1~exp4vulnerable
Debiansuricata141:8.0.0-1~exp5vulnerable
Debiansuricata141:8.0.1-1vulnerable
Debiansuricata141:8.0.1-2vulnerable
Debiansuricata141:8.0.1-3vulnerable
Debiansuricata141:8.0.1-3~bpo13+1vulnerable
Debiansuricata141:8.0.2-1vulnerable
Debiansuricata141:8.0.2-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-1vulnerable
Debiansuricata141:8.0.3-1~bpo13+1vulnerable
Debiansuricata141:8.0.3-2~exp1vulnerable
Debiansuricata141:8.0.4-1vulnerable
Debiansuricata141:8.0.4-1~bpo13+1vulnerable
Debiansuricata141:8.0.5-1vulnerable
Debiansuricata141:8.0.5-1~bpo13+1vulnerable
Debiansuricata141:8.0.6-1~bpo13+1vulnerable
Debiansuricata141:8.0.6-1fixed
Ubuntusuricata16.042.0.8-1build1vulnerable
Ubuntusuricata16.042.0.9-1vulnerable
Ubuntusuricata16.042.0.10-1vulnerable
Ubuntusuricata16.042.0.10-2vulnerable
Ubuntusuricata16.042.0.11-1vulnerable
Ubuntusuricata16.043.0-1vulnerable
Ubuntusuricata18.043.2-2ubuntu3vulnerable
Ubuntusuricata22.041:6.0.4-2vulnerable
Ubuntusuricata22.041:6.0.4-3vulnerable
Ubuntusuricata24.041:7.0.0-2vulnerable
Ubuntusuricata24.041:7.0.2-1vulnerable
Ubuntusuricata24.041:7.0.2-1build1vulnerable
Ubuntusuricata24.041:7.0.3-1build1vulnerable
Ubuntusuricata24.041:7.0.3-1build3vulnerable
Ubuntusuricata26.041:7.0.10-1vulnerable
Ubuntusuricata26.041:8.0.1-3build1vulnerable
Ubuntusuricata26.041:8.0.2-1vulnerable
Ubuntusuricata26.041:8.0.2-1build1vulnerable
Ubuntusuricata26.041:8.0.3-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansuricatadeb141:8.0.6-1Not reportedDEBIAN-CVE-2026-57223Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [suricata]Affected
    Details (4)

    • 1:7.0.10-1+deb13u4 · amd64 · trixie

      Affected

      pypi · suricata · debian · 13

    • 1:7.0.10-1+deb13u4 · arm64 · trixie

      Affected

      pypi · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · amd64 · trixie-backports

      Affected

      pypi · suricata · debian · 13

    • 1:8.0.6-1~bpo13+1 · arm64 · trixie-backports

      Affected

      pypi · suricata · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]