CVE-2015-3246High· 7.4▾ Abyssal⚠ Exploited in the wildPoC availablelibuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an erro…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 40.7 · likelihood 1.7 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Sep 9, 2026
7.1%
7.1% → 8.8%
5.1 → 7.4
medium → high
Last analysed / modified upstream
Exploit-DB · 1 GitHub repo · Metasploit ×1 (last check)
Added to the CISA catalog on Aug 26, 2026. Federal remediation due Sep 9, 2026. View catalog ↗
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
enterprise_linux = 5.0enterprise_linux = 6.0enterprise_linux = 7.0opensuse = 13.2libuser < 0.56.13-8libuser >= 0.60, < 0.60-7Upgrade past the affected range:
libuser 0.60-7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-30088High· 7.0Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-35311High· 8.8Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2025-38352High· 7.8In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls ha…
CVE-2024-30084High· 7.0Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2026-105481Medium· 6.5nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
CVE-2026-112940High· 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…