Freedesktop Polkit vulnerabilities

2 CVEs affecting Freedesktop Polkit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-4897, published 2026-03-26.

More from Freedesktop.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-2568, published 2017-02-13. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
• CVE-2026-4897, published 2026-03-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This…