CVE-2026-15059

ADVISORY - debian

Summary

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

systemd 261~rc3-1 [trixie] - systemd (Minor issue) [bookworm] - systemd (Minor issue) https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6 Fixed by: https://github.com/systemd/systemd/commit/cde88c4ea364e816619f385a870d074ebc12fe0f (v261-rc3) Fixed by: https://github.com/systemd/systemd/commit/a8feb2f23565d39df5c90a753c851c1934a53117 (v258.9)

EPSS Score⁠: 0.00119 (0.020)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-59⁠

Improper Link Resolution Before File Access ('Link Following')

Impacted images

Advisories

Debian

CREATED

29 days ago

UPDATED

12 days ago

ADVISORY IDCVE-2026-15059⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Package	Type	OS Name	OS Version	Affected Ranges	Fix Versions
debian/systemd	deb	debian	12	>0	Not yet available
debian/systemd	deb	debian	unstable	<261~rc3-1	261~rc3-1
debian/systemd	deb	debian	13	>0	Not yet available
debian/systemd	deb	debian	14	<261~rc3-1	261~rc3-1

Severity and metrics

No CVSS data available from this advisory.

NIST

CREATED

1 month ago

UPDATED

15 days ago

ADVISORY IDCVE-2026-15059⁠

EXPLOITABILITY SCORE

1.8

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-22⁠CWE-59⁠

CVSS SCORE

5.5medium

Ubuntu

CREATED

1 month ago

UPDATED

1 month ago

ADVISORY IDCVE-2026-15059⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium