{"id":"CVE-2025-7519","aliases":["AZL-65379","AZL-65415","DEBIAN-CVE-2025-7519","EUVD-2025-21350","GHSA-f8f8-m8xj-9xh7","MGASA-2026-0100","OESA-2025-1914","OESA-2025-1915","OESA-2025-1916","OESA-2025-1917","OESA-2025-1918","OESA-2025-1919","SUSE-SU-2025:02525-1","SUSE-SU-2025:02527-1","SUSE-SU-2025:02528-1","SUSE-SU-2025:20559-1","SUSE-SU-2025:20662-1","UBUNTU-CVE-2025-7519","USN-8173-1","openSUSE-SU-2026:10453-1"],"status":"published","title":"Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00221,"percentile":0.12724,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2025-07-14T13:35:21Z","modified":"2026-11-06T17:28:57Z","fixes":[{"ecosystem":"Azure Linux:2","package":"polkit","fixed_in":["0.119-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"polkit","fixed_in":["123-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"policykit-1","fixed_in":["127-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"polkit","fixed_in":["122-2.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"polkit","fixed_in":["123-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"polkit","fixed_in":["123-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"polkit","fixed_in":["123-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"polkit","fixed_in":["0.116-11.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"polkit","fixed_in":["0.120-11.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"polkit","fixed_in":["0.120-11.oe2203sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"polkit","fixed_in":["0.113-5.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"polkit","fixed_in":["0.113-5.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"polkit","fixed_in":["121-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"polkit","fixed_in":["0.116-150200.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"polkit","fixed_in":["121-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"polkit","fixed_in":["121-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"policykit-1","fixed_in":["0.105-33ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"policykit-1","fixed_in":["124-2ubuntu1.24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"policykit-1","fixed_in":["126-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.119-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["122-3","122-4","123-1","123-2","123-3","124-1","124-2","124-3","125-1","125-2","126-1","126-2","127-1","127-2","127-3","128-1"]},{"source":"osv","ecosystem":"Debian:13","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["126-2","127-1","127-2","127-3","128-1"]},{"source":"osv","ecosystem":"Debian:14","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"127-1"}]}],"versions":["126-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"122-2.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"123-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-11.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.120-11.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.120-11.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.116-150200.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"121-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-3ubuntu3","0.105-4ubuntu1","0.105-4ubuntu2","0.105-4ubuntu2.14.04.1","0.105-4ubuntu3.14.04.1","0.105-4ubuntu3.14.04.2","0.105-4ubuntu3.14.04.5","0.105-4ubuntu3.14.04.6","0.105-4ubuntu3.14.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-11ubuntu2","0.105-13","0.105-13ubuntu1","0.105-14","0.105-14.1","0.105-14.1ubuntu0.1","0.105-14.1ubuntu0.4","0.105-14.1ubuntu0.5","0.105-14.1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-18","0.105-20","0.105-20ubuntu0.18.04.1","0.105-20ubuntu0.18.04.4","0.105-20ubuntu0.18.04.5","0.105-20ubuntu0.18.04.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.105-26ubuntu1","0.105-26ubuntu1.1","0.105-26ubuntu1.2","0.105-26ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-33ubuntu0.1"}]}],"versions":["0.105-31","0.105-31ubuntu1","0.105-31.1","0.105-32","0.105-33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"124-2ubuntu1.24.04.3"}]}],"versions":["123-1","123-3","124-1","124-1ubuntu1","124-2ubuntu1","124-2ubuntu1.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"126-2ubuntu0.1"}]}],"versions":["126-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-33ubuntu0.1"}]}],"versions":["0.105-31","0.105-31ubuntu1","0.105-31.1","0.105-32","0.105-33"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"124-2ubuntu1.24.04.3"}]}],"versions":["123-1","123-3","124-1","124-1ubuntu1","124-2ubuntu1","124-2ubuntu1.24.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"126-2ubuntu0.1"}]}],"versions":["126-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"127-3.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-7519","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379675","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","report"]},{"url":"https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245","tags":["Patch","fix"]},{"url":"https://github.com/polkit-org/polkit/pull/570","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7519","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f8f8-m8xj-9xh7"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://www.freedesktop.org/software/polkit/releases/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/7xxx/CVE-2025-7519.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-7519","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0100.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35361","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8173-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1914","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1915","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1916","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1917","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1918","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1919","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502525-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246472","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7519","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502527-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502528-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520559-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520662-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-7519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-7519","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4897","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4897","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-7519","title":"Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T13:35:21.28Z","modified":"2026-11-05T16:07:30.432Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-05T17:53:58.265681Z"}],"euvd":[{"id":"EUVD-2025-21350","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T13:35:21Z","modified":"2026-11-05T16:07:30Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T18:00:58.377138Z"}],"ghsa":[{"id":"GHSA-f8f8-m8xj-9xh7","title":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in...","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T15:30:33Z","modified":"2025-07-25T18:32:58Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:03:07.428711Z"}],"nvd":[{"id":"CVE-2025-7519","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T14:15:25.593Z","modified":"2026-11-05T17:17:20.62Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"CVE-2025-7519","title":"Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T13:35:21.28Z","modified":"2026-11-07T07:03:47.682161917Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-07T03:07:58.953998Z"},{"id":"DEBIAN-CVE-2025-7519","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T14:15:25.593Z","modified":"2026-11-06T17:28:57.044071081Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-06T18:00:26.717991Z"},{"id":"OESA-2025-1914","title":"polkit security update","description":"polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it\u0026apos;s required to place the malicious policy file properly.(CVE-2025-7519)","status":"published","published":"2025-07-25T11:09:00Z","modified":"2026-08-18T01:18:55.603752313Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1915","title":"polkit security update","description":"polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it\u0026apos;s required to place the malicious policy file properly.(CVE-2025-7519)","status":"published","published":"2025-08-01T11:09:00Z","modified":"2026-08-18T01:18:55.566749098Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1916","title":"polkit security update","description":"polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it\u0026apos;s required to place the malicious policy file properly.(CVE-2025-7519)","status":"published","published":"2025-08-01T11:09:00Z","modified":"2026-08-18T01:18:55.604262674Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1917","title":"polkit security update","description":"polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it\u0026apos;s required to place the malicious policy file properly.(CVE-2025-7519)","status":"published","published":"2025-08-01T11:09:00Z","modified":"2026-08-18T01:18:55.772024343Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1918","title":"polkit security update","description":"polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it\u0026apos;s required to place the malicious policy file properly.(CVE-2025-7519)","status":"published","published":"2025-08-01T11:09:00Z","modified":"2026-08-18T01:18:55.712444984Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1919","title":"polkit security update","description":"polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it\u0026apos;s required to place the malicious policy file properly.(CVE-2025-7519)","status":"published","published":"2025-08-01T11:09:00Z","modified":"2026-08-18T01:18:55.591502631Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"UBUNTU-CVE-2025-7519","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T14:15:00Z","modified":"2026-04-22T16:15:51.224832Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-65379","title":"CVE-2025-7519 affecting package polkit for versions less than 0.119-4","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T14:15:25Z","modified":"2026-04-21T04:37:35.188028Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65415","title":"CVE-2025-7519 affecting package polkit for versions less than 123-3","description":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","status":"published","published":"2025-07-14T14:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.66471Z"},{"id":"MGASA-2026-0100","title":"Updated polkit-122 packages fix security vulnerability","description":"Polkit: xml policy file with a large number of nested elements may lead\nto out-of-bounds write. (CVE-2025-7519)\n","status":"published","published":"2026-04-17T19:56:32Z","modified":"2026-04-17T20:00:06.655622Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10453-1","title":"libpolkit-agent-1-0-127-3.1 on GA media","description":"These are all security issues fixed in the libpolkit-agent-1-0-127-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-28T00:00:00Z","modified":"2026-03-29T10:45:28.039874Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2025:02525-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\n- CVE-2025-7519: Fixed a XML policy file with a large number of nested elements that may lead to out-of-bounds write. (bsc#1246472)\n","status":"published","published":"2025-07-25T13:28:46Z","modified":"2026-03-23T04:48:36.584058Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02527-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\n- CVE-2025-7519: Fixed a XML policy file with a large number of nested elements that may lead to out-of-bounds write. (bsc#1246472)\n","status":"published","published":"2025-07-25T14:34:26Z","modified":"2026-03-23T04:46:38.777183Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02528-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\n- CVE-2025-7519: Fixed a XML policy file with a large number of nested elements that may lead to out-of-bounds write. (bsc#1246472)\n","status":"published","published":"2025-07-25T14:36:19Z","modified":"2026-03-23T04:47:47.451161Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:20559-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\n- CVE-2025-7519: Fixed that a XML policy file with a large number of\n  nested elements may lead to out-of-bounds write (bsc#1246472)\n","status":"published","published":"2025-08-20T11:34:24Z","modified":"2026-03-23T04:50:11.643928Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20662-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\n- CVE-2025-7519: Fixed that a XML policy file with a large number of nested elements may lead to out-of-bounds write (bsc#1246472).\n","status":"published","published":"2025-08-29T07:50:47Z","modified":"2026-03-23T04:50:54.420049Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-8173-1","title":"policykit-1 vulnerabilities","description":"It was discovered that polkit incorrectly handled nested elements in XML\npolicy files. If an administrator were tricked into installing a malicious\npolicy file, a remote attacker could possibly use this issue to cause\npolkit to crash, resulting in a denial of service. (CVE-2025-7519)\n\nPavel Kohout discovered that the polkit polkit-agent-helper-1 utility\nincorrectly handled long input. A local attacker could possibly use this\nissue to cause polkit to crash, resulting in a denial of service.\n(CVE-2026-4897)","status":"published","published":"2026-04-14T08:02:28Z","modified":"2026-04-27T18:48:00.224765Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}