CVE-2026-85498— Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
Quick assessment
Affected
Red Hat Red Hat Hardened Images
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 polkit 中发现一个安全漏洞。当处理以空字节（null byte）开头的输入时，认证代理辅助程序中的算术错误会导致在计算缓冲区长度时发生整数下溢，进而引发越界内存读取。能够构造恶意输入的攻击者可触发此漏洞，可能导致应用程序崩溃，从而造成拒绝服务（DoS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85498
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 127-5.1.hum1 ~ * |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-85498
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85498
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85498 (1)
Other References for CVE-2026-85498 (2)
Same Patch Batch · Red Hat · 2026-10-29 · 9 CVEs total
| CVE-2026-114488 | 7.4 HIGH | Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation |
| CVE-2026-15564 | 7.4 HIGH | Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization |
| CVE-2026-117548 | 6.5 MEDIUM | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem |
| CVE-2026-19610 | 6.5 MEDIUM | Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p |
| CVE-2026-117859 | 5.4 MEDIUM | Keycloak-services: keycloak-services: par single-use bypass via flow restart |
| CVE-2026-117627 | 5.4 MEDIUM | Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider l |
| CVE-2026-117688 | 5.3 MEDIUM | Keycloak-services: keycloak-services: vault secret disclosure via client registration inst |
| CVE-2026-118030 | 4.2 MEDIUM | Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
-
CVE-2026-85518
Openscap: openscap: arbitrary file write via path traversal -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad -
CVE-2026-85977
Libtirpc: libtirpc: denial of service via unbounded memory a -
CVE-2026-88842
Busybox: busybox: dpkg stale field_start pointer causes out- -
CVE-2026-88829
Busybox: busybox: http request smuggling via pipelined reque
Same vendor: Red Hat
-
CVE-2026-117859
Keycloak-services: keycloak-services: par single-use bypass -
CVE-2026-118030
Keycloak-services: keycloak-services: hotp race condition al -
CVE-2026-117688
Keycloak-services: keycloak-services: vault secret disclosur -
CVE-2026-117548
389-ds-base: 389-ds-base: null pointer dereference via modif -
CVE-2026-117627
Keycloak-services: keycloak-services: jwt authorization gran
Same weakness: CWE-125
-
CVE-2026-115942
Apache Qpid Proton C: Verifying non compliant TLS wildcard c -
CVE-2026-118608
Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test -
CVE-2026-103393
Session Smart Router: An attacker can cause an out-of-bounds -
CVE-2026-103390
Session Smart Router and Session Smart Conductor: A malforme -
CVE-2026-58496
ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memor