Critical Command Injection Vulnerability in ABRT Package Leading to Local Privilege Escalation
Summary
ALSA-2025:22760: Important: abrt security update. Affects abrt versions < 2.10.9-25.el8_10.alma.1. Fixed in 2.10.9-25.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Automatic Bug Reporting Tool (ABRT) is a utility designed to detect defects in applications and generate bug reports that assist maintainers in addressing these issues. ABRT employs a plug-in architecture to enhance its capabilities, making it a vital tool for developers and system administrators. However, a recent vulnerability has been identified that could allow unauthorized users to escalate their privileges locally, posing a significant security risk.
Vulnerability Detail
The vulnerability, identified as CVE-2025-12744, is a command injection flaw within the ABRT package. This issue arises from improper handling of user input, allowing an attacker to execute arbitrary commands with elevated privileges. The ramifications of this vulnerability are severe, as it could enable unauthorized users to gain control over the system, potentially leading to data breaches or system compromise. The vulnerability affects multiple components of the ABRT package, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.10.9-25.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update abrtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the ABRT service or disable it until the package is updated. This can be done by running the following command:
sudo systemctl stop abrt-ccpp.service
Additionally, users should ensure that only trusted users have access to the system to mitigate the risk of exploitation.
Conclusion
The ABRT package has a critical vulnerability (CVE-2025-12744) that allows for command injection and local privilege escalation. It is essential for users to update their packages to the fixed version to mitigate the risk. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for abrt →
FAQ
CVE-2025-12744 is a command injection vulnerability in the ABRT package that can lead to local privilege escalation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to execute arbitrary commands with elevated privileges, leading to system compromise.
You can update the ABRT package by running the command: sudo dnf update abrt abrt-addon-ccpp abrt-addon-coredump-helper abrt-addon-kerneloops abrt-addon-pstoreoops abrt-addon-vmcore abrt-addon-xorg abrt-cli abrt-cli-ng abrt-console-notification abrt-dbus abrt-desktop abrt-gui abrt-gui-libs abrt-libs abrt-plugin-machine-id abrt-plugin-sosreport abrt-tui python3-abrt python3-abrt-addon python3-abrt-container-addon python3-abrt-doc.
If you cannot update immediately, consider stopping the ABRT service and restricting access to the system as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for abrt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
