$ cve CVE-2015-3246 JSON

CVE-2015-3246 KEV EXPLOIT

5.1

MEDIUM · CVSS 3.1 · EPSS 8.8% (pctl 95)

Patch first

On CISA KEV — known exploited in the wild, due 2026-09-09.

Description

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

Scoring

CVSS	5.1 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS	8.8% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-264
On CISA KEV	yes — remediate by 2026-09-09
Public exploit	yes
Published	2015-08-11
Last modified	2026-08-27

CISA KEV

Name	Red Hat Libuser Race Condition Vulnerability
Added	2026-08-26
Due	2026-09-09
Vendor / product	Red Hat / Libuser
Ransomware use	none reported

Affected (3)

Vendor	Product
libuser project	libuser
opensuse	opensuse
redhat	enterprise linux

Public exploits

Source	Title	Date
exploit-db	Libuser - 'roothelper' Local Privilege Escalation (Metasploit)	2018-05-16
exploit-db	Libuser Library - Multiple Vulnerabilities	2015-07-27

References

→ the Explorer · watch your stack · NVD