Description
A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | abrt | < 2.17.7 | 2.17.7 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | abrt +21 | 2.10.9-25.el8_10 | RHSA-2025:22760 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 TUS | abrt +21 | 2.10.9-25.el8_8 | RHSA-2025:23030 |
| RHEL 8.8 E4S | abrt +21 | 2.10.9-25.el8_8 | RHSA-2025:23030 |
| RHEL 8.6 TUS | abrt +21 | 2.10.9-25.el8_6 | RHSA-2025:23032 |
| RHEL 8.6 E4S | abrt +21 | 2.10.9-25.el8_6 | RHSA-2025:23032 |
| RHEL 8.6 AUS | abrt +21 | 2.10.9-25.el8_6 | RHSA-2025:23032 |
| RHEL 8.4 EUS Long Life | abrt +21 | 2.10.9-25.el8_4 | RHSA-2025:23033 |
| RHEL 8.4 AUS | abrt +21 | 2.10.9-25.el8_4 | RHSA-2025:23033 |
| RHEL 8.2 AUS | abrt +21 | 2.10.9-25.el8_2 | RHSA-2025:23031 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | abrt +21 | 2.10.9-25.el8_10.alma.1 | ALSA-2025:22760 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | abrt | 2.10.9-25.el8_10.rocky.0.1 | RLSA-2025:22760 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | abrt +21 | 2.10.9-25.0.1.el8_10 | ELSA-2025-22760 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Fedora - Local Privilege Escalation EDB-52515 · local · Apr 29, 2026
GitHub 1 repository
-
initstring/abrt_root ★ 7 · Oct 18, 2025
Privilege escalation in Fedora Linux via ABRT (Automatic Bug Reporting Tool): CVE-2025-12744
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- RHSA-2025:23030 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALSA-2025:22760 Important: abrt security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:23033 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:23031 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:23032 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RHSA-2025:22760 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RLSA-2025:22760 Important: abrt security update Rocky Linux Security Advisories · May 21, 2026
- WID-SEC-2025-2748 Red Hat Enterprise Linux (ABRT): Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Dec 10, 2025
- ELSA-2025-22760 Important: abrt security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 5, 2025
References
- https://access.redhat.com/security/cve/CVE-2025-12744 vdb-entry
- RHBZ#2412467 issue-tracking