UBUNTU-CVE-2026-85498: Low severity ubuntu/policykit-1 vulnerability

Q: Is user interaction needed for an exploit attempt?

No. The CVSS vector indicates no user interaction is required, but the attacker needs low-level privileges and must be able to supply crafted input over an adjacent-network attack path.

Q: Does successful exploitation disclose or modify data?

No confidentiality or integrity impact is indicated. The stated impact is low availability impact, with the flaw potentially causing an application crash.

Published Sep 7, 2026

Updated

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

Affected Software

7 affected componentsFixes available

ubuntu/policykit-1*

ubuntu/policykit-1<0.105-33ubuntu0.2

0.105-33ubuntu0.2

ubuntu/policykit-1<124-2ubuntu1.24.04.4

124-2ubuntu1.24.04.4

ubuntu/policykit-1<127-2ubuntu1.1

127-2ubuntu1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/policykit-1 to a version that resolves this vulnerability.
Fixed in 0.105-33ubuntu0.2
Upgrade
Upgrade ubuntu/policykit-1 to a version that resolves this vulnerability.
Fixed in 124-2ubuntu1.24.04.4
Upgrade
Upgrade ubuntu/policykit-1 to a version that resolves this vulnerability.
Fixed in 127-2ubuntu1.1

Event History

Sep 7, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Is user interaction needed for an exploit attempt?

No. The CVSS vector indicates no user interaction is required, but the attacker needs low-level privileges and must be able to supply crafted input over an adjacent-network attack path.

Does successful exploitation disclose or modify data?

No confidentiality or integrity impact is indicated. The stated impact is low availability impact, with the flaw potentially causing an application crash.

UBUNTU-CVE-2026-85498: Low severity ubuntu/policykit-1 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Is user interaction needed for an exploit attempt?

Does successful exploitation disclose or modify data?

Company

Resources

Contact

Frequently Asked Questions

Is user interaction needed for an exploit attempt?

Does successful exploitation disclose or modify data?