CVE-2026-40228 | Low | 2.9 | 2026-04-10 | In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToW… |
CVE-2026-40227 | Medium | 6.2 | 2026-04-10 | In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. |
CVE-2026-40226 | Medium | 6.4 | 2026-04-10 | In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. |
CVE-2026-40225 | Medium | 6.4 | 2026-04-10 | In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output. |
CVE-2026-40224 | Medium | 6.7 | 2026-04-10 | In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace. |
CVE-2026-40223 | Medium | 4.7 | 2026-04-10 | In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running. |
CVE-2026-29111 | Medium | 5.5 | 2026-03-23 | systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version… |
CVE-2025-4598 | Medium | 4.7 | 2025-05-30 | A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access th… |
CVE-2023-7008 | Medium | 5.9 | 2023-12-23 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signatur… |
CVE-2023-31439 | Medium | 5.3 | 2023-06-13 | An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the… |
CVE-2023-31438 | Medium | 5.3 | 2023-06-13 | An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error… |
CVE-2023-31437 | Medium | 5.3 | 2023-06-13 | An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are display… |
CVE-2023-26604 | High | 7.8 | 2023-03-03 | systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl sta… |
CVE-2022-4415 | Medium | 5.5 | 2023-01-11 | A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel… |
CVE-2022-45873 | Medium | 5.5 | 2022-11-23 | systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object… |
CVE-2022-3821 | Medium | 5.5 | 2022-11-08 | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accurac… |
CVE-2022-2526 | Critical | 9.8 | 2022-09-09 | A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-s… |
CVE-2021-3997 | Medium | 5.5 | 2022-08-23 | A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are cr… |
CVE-2021-33910 | Medium | 5.5 | 2021-07-20 | basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a… |
CVE-2020-13529 | Medium | 6.1 | 2021-05-10 | An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to… |
CVE-2020-13776 | Medium | 6.7 | 2020-06-03 | systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privil… |
CVE-2020-1712 | High | 7.8 | 2020-03-31 | A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages… |
CVE-2012-1101 | Medium | 5.5 | 2020-03-11 | systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure). |
CVE-2019-20386 | Low | 2.4 | 2020-01-21 | An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. |
CVE-2018-21029 | Critical | 9.8 | 2019-10-30 | systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there… |
CVE-2019-15718 | Medium | 4.4 | 2019-09-04 | In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls s… |
CVE-2018-20839 | Medium | 4.3 | 2019-05-17 | systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or us… |
CVE-2019-3844 | High | 7.8 | 2019-04-26 | It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to cre… |
CVE-2019-3843 | High | 7.8 | 2019-04-26 | It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID… |
CVE-2019-3842 | High | 7.0 | 2019-04-09 | In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible fo… |
CVE-2019-6454 | Medium | 5.5 | 2019-03-21 | An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporar… |
CVE-2018-16888 | Medium | 4.7 | 2019-01-14 | It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged u… |
CVE-2018-16865 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entrie… |
CVE-2018-16864 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program w… |
CVE-2018-16866 | Low | 3.3 | 2019-01-11 | An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw… |
CVE-2018-15688 | High | 8.8 | 2018-10-26 | A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases… |
CVE-2018-15687 | High | 7.0 | 2018-10-26 | A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd v… |
CVE-2018-15686 | High | 7.8 | 2018-10-26 | A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to i… |
CVE-2018-1049 | Medium | 5.9 | 2018-02-16 | In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd res… |
CVE-2018-6954 | High | 7.8 | 2018-02-13 | systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary… |
CVE-2017-18078 | High | 7.8 | 2018-01-29 | systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned… |
CVE-2017-15908 | High | 7.5 | 2017-10-26 | In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_t… |
CVE-2015-7510 | Critical | 9.8 | 2017-09-25 | Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. |
CVE-2017-1000082 | Critical | 9.8 | 2017-07-07 | systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rath… |
CVE-2017-9445 | High | 7.5 | 2017-06-28 | In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server c… |
CVE-2017-9217 | High | 7.5 | 2017-05-24 | systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section. |
CVE-2016-10156 | High | 7.8 | 2017-01-23 | A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers… |
CVE-2016-7796 | Medium | 5.5 | 2016-10-13 | The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a noti… |
CVE-2016-7795 | Medium | 5.5 | 2016-10-13 | The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a… |
CVE-2012-0871 | | | 2014-04-18 | The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite… |
CVE-2013-4394 | | | 2013-10-28 | The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts… |
CVE-2013-4393 | | | 2013-10-28 | journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafte… |
CVE-2013-4392 | Medium | 5.0 | 2013-10-28 | systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on… |
CVE-2013-4391 | | | 2013-10-28 | Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and poss… |
CVE-2013-4327 | | | 2013-10-03 | systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a… |