Libuser bug can crash services

Published August 20, 2026 CVE-2015-3246

A years-old flaw in libuser, a Linux tool that changes user accounts, could leave the password file in a broken state. On Linux systems using the affected userhelper program, a local user could trigger this by causing an error mid-update, and combined with a second bug it could let them gain higher privileges instead of just breaking logins.

Severity
HighCVSS 2.0 · 7.2
Fix
Fixed in 0.56.13-8, 0.60-7Fix recorded on Aug 26, 2026
Affected versions
before 0.56.13-8; before 0.60-7
Weakness
CWE-264
Exploit likelihood
8.8% in 30 daysEPSS, higher than 95% of known flaws
Affects
libuser+2 more
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 26, 2026
Federal fix deadline
Sep 9, 2026

How it works

userhelper writes changes straight into the system's /etc/passwd file instead of writing to a temporary file first, so if something goes wrong partway through the write, the account file is left in a broken, inconsistent state.

What to do

Check the installed libuser package version with your distribution's package manager and compare it against 0.56.13-8 or 0.60-7. Only local users with shell access to the affected system can trigger this, not remote attackers over the network.

Run this in the application environment you want to check:

apt policy libuser

Update libuser and the usermode package to 0.56.13-8, 0.60-7, or a later version through your distribution's normal update channel, such as apt or yum. Debian's wheezy fix shipped as 1:the latest version.

Technical details

Affected software: libuser, usermode, userhelper

The source identifies libuser as the affected product. Affected ranges: older than 0.56.13-8, older than 0.60-7. Fixed versions: 0.56.13-8, 0.60-7.

Severity breakdown

  • Access vector Local Needs local access to the machine
  • Access complexity Low Low complexity under the assessed conditions
  • Authentication None No login required
  • Confidentiality impact Complete Total information disclosure
  • Integrity impact Complete Total loss of data integrity
  • Availability impact Complete Total shutdown of the resource
AV:L/AC:L/Au:N/C:C/I:C/A:C Open in FIRST.org calculator

References

View Original Source