CVE-2021-3939

Free of static data in accountsservice

7.8 HighFix available

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.37%Down 0.3 points since Nov 17, 2021

What each source reports

CVE List Score used 7.8

Free of static data in accountsservice

Record: CVE-2021-3939
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-590
Updated: 2026-11-02

EUVDEUVD-2021-27152 7.8

Record: EUVD-2021-27152
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jxh7-q7rm-43ww 7.8

Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language...

Record: GHSA-jxh7-q7rm-43ww
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-590, CWE-763
Updated: 2026-11-02

NVD 7.8

Record: CVE-2021-3939
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-590, CWE-763
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-3939 7.8

Record: UBUNTU-CVE-2021-3939
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-5149-1 No score

accountsservice vulnerability

Kevin Backhouse discovered that AccountsService incorrectly handled memory when performing certain language setting operations. A local attacker could use this issue to escalate privileges.

Record: USN-5149-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`accountsservice` Ubuntu:20.04:LTS	before 0.6.55-0ubuntu12~20.04.5, plus listed versions 0.6.55-0ubuntu100.6.55-0ubuntu110.6.55-0ubuntu12~20.04.10.6.55-0ubuntu12~20.04.20.6.55-0ubuntu12~20.04.4	0.6.55-0ubuntu12~20.04.5
`accountsservice` Ubuntu:22.04:LTS	before 0.6.55-3ubuntu2, plus listed versions 0.6.55-0ubuntu140.6.55-3ubuntu1	0.6.55-3ubuntu2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3939 is a high vulnerability (CVSS 7.8) in Canonical Accountsservice, published November 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in accountsservice 0.6.55-0ubuntu12~20.04.5.