Vulnerabilities in systemd
11 resultsCVE-2018-15686HIGHsystemd: reexec state injection: fgets() on overlong lines leads to line splittingEPSS 2.3%CVE-2018-15688HIGHOut-of-Bounds write in systemd-networkd dhcpv6 option handlingEPSS 1.7%CVE-2018-15687HIGHsystemd: chown_one() can dereference symlinksEPSS 1.1%CVE-2012-1101—systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure).EPSS 0.4%CVE-2026-40227MEDIUMIn systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.EPSS 0.2%CVE-2026-40228LOWIn systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is execEPSS 0.2%CVE-2026-40225MEDIUMIn udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.EPSS 0.1%CVE-2026-29111MEDIUMsystemd: Local unprivileged user can trigger an assertEPSS 0.1%CVE-2026-40223MEDIUMIn systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.EPSS 0.1%CVE-2026-40224MEDIUMIn systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.EPSS 0.1%CVE-2026-40226MEDIUMIn nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.EPSS 0.1%