CVE-2025-12744: Abrt: command-injection in abrt leading to local privilege escalation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-03 · updated 2026-10-18
Weakness: CWE-78

Description

A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.

Affected products

Red Hat Enterprise Linux 8: all versions

References

https://access.redhat.com/security/cve/CVE-2025-12744
https://bugzilla.redhat.com/show_bug.cgi?id=2412467

Get alerted when CVE-2025-12744 or the next vulnerability affects your stack