Improper Privilege Management in Apport Affects Users with Automatic Crash Reporting Enabled

CVE-2026-84410

What is CVE-2026-84410?

An improper privilege management flaw in Apport, prior to version 2.37.0, allows an unprivileged local attacker to exploit systems with automatic crash reporting enabled. The vulnerability exists due to the automatic crash report processing pipeline executing with root privileges. By placing a malicious crash file in the world-writable /var/crash directory, an attacker can specify an attacker-controlled ExecutablePath. This causes the dynamic loader to execute arbitrary code through an audit module defined by the ELF's DT_AUDIT tag, leading to full system compromise.

References