CVE-2026-4897
published 2026-03-26CVE-2026-4897: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.15%
3.9th percentile
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | policykit-1 | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| polkit_project | polkit | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_ubuntu6.7MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
vendor_redhat·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CWE-125 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
No description is available for this CVE.
Statement: This issue is classified as Low severity because there is no observable effect of the one byte out-of-bounds read. No information disclosure or affect to integrity has been demonstrated.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the criteria for a mitigation as defined by the Red Hat Product Security team. This flaw remains subject to future review as new information becomes available. Exposure is limited: the defect is reachable only by a local/adjacent low-privileged user interacting with the polkit authentication agent and results at most in a crash (availability) of the affected
Ubuntu
polkit vulnerabilities
vendor_ubuntu·2026-04-14·CVSS 6.7
CVE-2025-7519 [MEDIUM] polkit vulnerabilities
Title: polkit vulnerabilities
Summary: Several security issues were fixed in polkit.
It was discovered that polkit incorrectly handled nested elements in XML
policy files. If an administrator were tricked into installing a malicious
policy file, a remote attacker could possibly use this issue to cause
polkit to crash, resulting in a denial of service. (CVE-2025-7519)
Pavel Kohout discovered that the polkit polkit-agent-helper-1 utility
incorrectly handled long input. A local attacker could possibly use this
issue to cause polkit to crash, resulting in a denial of service.
(CVE-2026-4897)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
polkit: Polkit: Denial of Service via unbounded input processing through standard input
vendor_redhat·2026-03-26·CVSS 5.5
CVE-2026-4897 [MEDIUM] CWE-770 polkit: Polkit: Denial of Service via unbounded input processing through standard input
polkit: Polkit: Denial of Service via unbounded input processing through standard input
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Statement: A moderate severity issue, a denial of service flaw exists in polkit where a l
Debian
CVE-2026-4897: policykit-1 - A flaw was found in polkit. A local user can exploit this by providing a special...
vendor_debian·2026·CVSS 5.5
CVE-2026-4897 [MEDIUM] CVE-2026-4897: policykit-1 - A flaw was found in polkit. A local user can exploit this by providing a special...
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-4897: A flaw was found in polkit
osv·2026-03-26·CVSS 5.5
CVE-2026-4897 [MEDIUM] CVE-2026-4897: A flaw was found in polkit
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
GHSA
GHSA-v4jf-wwp4-588q: A flaw was found in polkit
ghsa_unreviewed·2026-03-26
CVE-2026-4897 [MEDIUM] CWE-770 GHSA-v4jf-wwp4-588q: A flaw was found in polkit
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-85498 deepin-polkit-agent: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 deepin-polkit-agent: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 deepin-polkit-agent: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1
Bugzilla
CVE-2026-85498 polkit-qt: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-qt: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 polkit-qt: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MA
Bugzilla
CVE-2026-85498 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX,
Bugzilla
CVE-2026-85498 polkit-gnome: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-gnome: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 polkit-gnome: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_M
Bugzilla
CVE-2026-85498 kdeplasma-addons: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 kdeplasma-addons: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 kdeplasma-addons: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to
Bugzilla
CVE-2026-85498 mate-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 mate-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 mate-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MA
Bugzilla
CVE-2026-85498 polkit-kde: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-kde: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 polkit-kde: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_M
Bugzilla
CVE-2026-85498 cosmic-settings: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 cosmic-settings: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 cosmic-settings: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to S
Bugzilla
CVE-2026-85498 polkit-qt-1: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-qt-1: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 polkit-qt-1: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_
Bugzilla
CVE-2026-85498 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
CVE-2026-85498 polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX, and buf[SIZE_MAX] is an out-of-bounds read. On a typical two's-complement 64-bit target the pointer arithmetic wraps modulo 2^64, so in practice this reads buf[-1] - one byte immediately before the stack buffer.
Bugzilla
CVE-2026-85498 rust-zbus_polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 rust-zbus_polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 rust-zbus_polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to
Bugzilla
CVE-2026-85498 mate-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 mate-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 mate-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_
Bugzilla
CVE-2026-85498 cosmic-initial-setup: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 cosmic-initial-setup: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 cosmic-initial-setup: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1
Bugzilla
CVE-2026-85498 xfce-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 xfce-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 xfce-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_
Bugzilla
CVE-2026-85498 xfce-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 xfce-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 xfce-polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MA
Bugzilla
CVE-2026-85498 polkit-qt: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-qt: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 polkit-qt: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX,
Bugzilla
CVE-2026-85498 polkit-pkla-compat: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-pkla-compat: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 polkit-pkla-compat: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 t
Bugzilla
CVE-2026-85498 polkit-kde: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-kde: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 polkit-kde: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX
Bugzilla
CVE-2026-85498 polkit-qt-1: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 polkit-qt-1: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 polkit-qt-1: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MA
Bugzilla
CVE-2026-85498 deepin-api: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 deepin-api: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
CVE-2026-85498 deepin-api: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_M
Bugzilla
CVE-2026-85498 rust-zbus_polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 rust-zbus_polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 rust-zbus_polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SI
Bugzilla
CVE-2026-85498 kdeplasma-addons: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
bugzilla·2026-09-04·CVSS 5.5
CVE-2026-85498 [MEDIUM] CVE-2026-85498 kdeplasma-addons: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
CVE-2026-85498 kdeplasma-addons: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in read_cookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SI
Bugzilla
CVE-2026-4897 polkit: Polkit: Denial of Service via unbounded input processing through standard input
bugzilla·2026-03-26·CVSS 4.6
CVE-2026-4897 [MEDIUM] CVE-2026-4897 polkit: Polkit: Denial of Service via unbounded input processing through standard input
CVE-2026-4897 polkit: Polkit: Denial of Service via unbounded input processing through standard input
The helper supports two ways to receive the cookie: via `argv[2]` when `argc == 3`, or via stdin when `argc == 2`. The latter is the path used by the polkit agent when it spawns the setuid helper: it passes only the username and writes the cookie on stdin (to avoid exposing it in process listings, as per CVE-2015-4625). The problematic code is in `src/polkitagent/polkitagenthelperprivate.c`:
```c
if (argc == 3)
return strdup (argv[2]);
else
{
char *ret = NULL;
size_t n = 0;
ssize_t r = getline (&ret, &n, stdin);
if (r == -1)
{
if (!feof (stdin))
perror ("getline");
free (ret);
return NULL;
}
else
{
g_strchomp (ret);
return ret;
}
}
```
There is no limit on the length of the line read fr
Wiz
CVE-2026-4897 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-4897 [MEDIUM] CVE-2026-4897 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-4897 :
Linux Debian vulnerability analysis and mitigation
polkit-agent-helper-1
Source : NVD
## 5.5
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 5.5
Affected Technologies
Linux Debian
Linux Fedora
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
polkit-debugsource
polkit-devel
Sources
NVD
Debian 11, 12, 13, 14 Severity MEDIUM No Fix Added at: Mar 29, 2026
Echo Severity MEDIUM No Fix Added at: Mar 29, 2026
Red Hat 6, 7, 8, 9, 10 Severity MEDIUM No Fix Added at: Mar 29, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploi
2026-03-26
Published