Remote Code Execution Vulnerability in pam_usb by mcdope

CVE-2026-44712

What is CVE-2026-44712?

The pam_usb tool, used for hardware authentication on Linux systems via USB devices, has a vulnerability that allows for remote code execution. When configured with a carefully crafted UUID, an attacker can exploit this flaw by invoking the pamusb-conf utility with specific options. This exploitation occurs during the addition of a device and can lead to unauthorized access and system compromise. Affected versions prior to 0.8.7 are susceptible to this vulnerability, as they inadequately handle user-provided input, allowing a potential attacker to execute arbitrary commands via the os.system() call in pamusb-agent.

References