Systemd
Source repositories
CVEs (61)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-40227 | Med | 0.40 | 6.2 | 0.00 | Apr 10, 2026 | In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. | ||
| CVE-2020-13529 | Med | 0.40 | 6.1 | 0.01 | May 10, 2021 | An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to… | ||
| CVE-2018-1049 | Med | 0.39 | 5.9 | 0.07 | Feb 16, 2018 | In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like… | ||
| CVE-2023-7008 | Med | 0.38 | 5.9 | 0.01 | Dec 23, 2023 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. | ||
| CVE-2026-40224 | Med | 0.37 | 6.7 | 0.00 | Apr 10, 2026 | In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace. | ||
| CVE-2026-15059 | Med | 0.36 | 5.5 | 0.00 | Aug 10, 2026 | Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation. | ||
| CVE-2012-1101 | Med | 0.36 | 5.5 | 0.00 | Mar 11, 2020 | systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure). | ||
| CVE-2019-6454 | Med | 0.36 | 5.5 | 0.02 | Mar 21, 2019 | An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a… | ||
| CVE-2016-7796 | Med | 0.36 | 5.5 | 0.01 | Oct 13, 2016 | The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled. | ||
| CVE-2016-7795 | Med | 0.36 | 5.5 | 0.01 | Oct 13, 2016 | The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket. | ||
| CVE-2026-40226 | Med | 0.35 | 6.4 | 0.00 | Apr 10, 2026 | In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. | ||
| CVE-2026-40225 | Med | 0.35 | 6.4 | 0.00 | Apr 10, 2026 | In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. | ||
| CVE-2023-31437 | Med | 0.34 | 5.3 | 0.00 | Jun 13, 2023 | An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability." | ||
| CVE-2013-4392 | Med | 0.33 | 5.0 | 0.00 | Oct 28, 2013 | systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files. | ||
| CVE-2026-15060 | Med | 0.31 | 4.7 | 0.00 | Aug 10, 2026 | When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259… | ||
| CVE-2026-40223 | Med | 0.31 | 4.7 | 0.00 | Apr 10, 2026 | In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User= unit exists and is running. | ||
| CVE-2025-4598 | Med | 0.31 | 4.7 | 0.01 | May 30, 2025 | A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content,… | ||
| CVE-2018-16888 | Med | 0.31 | 4.7 | 0.00 | Jan 14, 2019 | It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned… | ||
| CVE-2026-29111 | Med | 0.29 | 5.5 | 0.00 | Mar 23, 2026 | systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version… | ||
| CVE-2019-15718 | Med | 0.29 | 4.4 | 0.01 | Sep 4, 2019 | In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by… |
- risk 0.40cvss 6.2epss 0.00
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.
- risk 0.40cvss 6.1epss 0.01
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to…
- risk 0.39cvss 5.9epss 0.07
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like…
- risk 0.38cvss 5.9epss 0.01
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
- risk 0.37cvss 6.7epss 0.00
In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.
- risk 0.36cvss 5.5epss 0.00
Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.
- risk 0.36cvss 5.5epss 0.00
systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure).
- risk 0.36cvss 5.5epss 0.02
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a…
- risk 0.36cvss 5.5epss 0.01
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
- risk 0.36cvss 5.5epss 0.01
The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.
- risk 0.35cvss 6.4epss 0.00
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
- risk 0.35cvss 6.4epss 0.00
In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.
- risk 0.34cvss 5.3epss 0.00
An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."
- risk 0.33cvss 5.0epss 0.00
systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.
- risk 0.31cvss 4.7epss 0.00
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259…
- risk 0.31cvss 4.7epss 0.00
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User= unit exists and is running.
- risk 0.31cvss 4.7epss 0.01
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content,…
- risk 0.31cvss 4.7epss 0.00
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned…
- risk 0.29cvss 5.5epss 0.00
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version…
- risk 0.29cvss 4.4epss 0.01
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by…
Page 2 of 4