Executive Summary

Local users can exploit libuser in the userhelper program to directly modify /etc/passwd, causing an error that leads to a denial of service via inconsistent file state. When combined with CVE-2015-3245, the flaw can be leveraged for privilege escalation. The vulnerability is actively exploited in the wild (CISA KEV).

---

Authoritative CVE Metadata - CVSS Base Score: 7.4 (HIGH) - Published: 2015-08-11T14:59:07.040 - Last Modified: 2026-10-02T11:33:29.473

[!CAUTION] Known Exploited Vulnerability: YES (CISA KEV Added: 2026-08-26)

Original Description: libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

"If you have knowledge, let others light their candles in it."

— Margaret Fuller