CVE-2018-15686: systemd: reexec state injection: fgets() on overlong lines leads to line splitting
Vulnerability summary
CVE-2018-15686 is a high (CVSS 7.8) Deserialization of Untrusted Data vulnerability in canonical ubuntu_linux. EPSS estimates a 2.26% chance of exploitation in the next 30 days, higher than 83% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (exploit-database, 29-10-2018)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 9Timeline
- 26-10-2018PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.26%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.26% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundsystemd - 'reexec' State Injection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard5 products
- py3-systemdAll versions (No fix recorded)
- py3.10-systemdAll versions (No fix recorded)
- py3.11-systemdAll versions (No fix recorded)
- py3.12-systemdAll versions (No fix recorded)
- py3.13-systemdAll versions (No fix recorded)
Debian2 products
- systemd< 239-12
- debian_linuxEOL8.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 18.10
Oracle1 product
Systemd1 product
- systemd≥ unspecified, ≤ 239
Systemd_project1 product
- systemd≤ 239
Ubuntu1 product
- systemd< 229-4ubuntu21.8 | < 237-3ubuntu10.6
7 vendors · 12 products
References
16 links
lists.debian.org/debian-lts-announce/2018/11/msg00017.htmlMailing ListX Refsource MLISTThird Party AdvisoryAdvisory- www.exploit-db.com/exploits/45714/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB EntryEVIDENCE
- access.redhat.com/errata/RHSA-2019:2091Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2019:3222Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2020:0593Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
