CVE-2025-7519 — Out-of-bounds Write in Redhat Enterprise Linux
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 98.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 14
Latest updateApr 14
Description
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9
Affected Packages0 packages
Also affects: Enterprise Linux 10.0, 6.0, 7.0, 8.0, 9.0, Openshift Container Platform 4.0
Patches
🔴Vulnerability Details
4📋Vendor Advisories
4Red Hat▶
polkit: XML policy file with a large number of nested elements may lead to out-of-bounds write↗2025-07-11
Microsoft▶
Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write↗2025-07-08
Debian▶
CVE-2025-7519: policykit-1 - A flaw was found in polkit. When processing an XML policy with 32 or more nested...↗2025