Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-12744

Abrt: command-injection in abrt leading to local privilege escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

abrt

Default version status: unaffected

  • 0 to < 2.17.7affected

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

References