CVE-2026-40223
CVE-2026-40223 is a medium-severity vulnerability in Systemd Project Systemd with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-696.
Key facts
- Severity: Medium (CVSS 3.x base score 4.7)
- EPSS exploit prediction: 0% (1st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-21394
- Weakness: CWE-696
- Affected product: Systemd Project Systemd
- Published:
- Last modified:
Description
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
Frequently asked questions
- What is CVE-2026-40223?
- In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- How severe is CVE-2026-40223?
- CVE-2026-40223 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-40223 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-40223?
- CVE-2026-40223 affects Systemd Project Systemd. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-40223?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-40223 have an EU (EUVD) identifier?
- Yes. CVE-2026-40223 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21394.
- When was CVE-2026-40223 published?
- CVE-2026-40223 was published on 2026-04-10 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
More vulnerabilities in Systemd Project Systemd
- CVE-2022-2526 — Critical (CVSS 9.8): A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and…
- CVE-2018-21029 — Critical (CVSS 9.8): systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name…
- CVE-2015-7510 — Critical (CVSS 9.8): Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
- CVE-2017-1000082 — Critical (CVSS 9.8): systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the…
- CVE-2018-15688 — High (CVSS 8.8): A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory…
- CVE-2023-26604 — High (CVSS 7.8): systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible…
All CVEs affecting Systemd Project Systemd →
Other CWE-696 vulnerabilities
- CVE-2026-45033 — High (CVSS 7.8): GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security…
- CVE-2025-31485 — High (CVSS 7.5): API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL…
- CVE-2021-22569 — High (CVSS 7.5): An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that…
- CVE-2021-31379 — High (CVSS 7.5): An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS…
- CVE-2026-35637 — High (CVSS 7.3): OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite…
- CVE-2024-24853 — High (CVSS 7.2): Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R)…