CVE-2026-40227
CVE-2026-40227 is a medium-severity vulnerability in Systemd Project Systemd with a CVSS 3.x base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1025.
Key facts
- Severity: Medium (CVSS 3.x base score 6.2)
- EPSS exploit prediction: 0% (10th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-21402
- Weakness: CWE-1025
- Affected product: Systemd Project Systemd
- Published:
- Last modified:
Description
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.
Frequently asked questions
- What is CVE-2026-40227?
- In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.
- How severe is CVE-2026-40227?
- CVE-2026-40227 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-40227 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-40227?
- CVE-2026-40227 affects Systemd Project Systemd. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-40227?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-40227 have an EU (EUVD) identifier?
- Yes. CVE-2026-40227 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-21402.
- When was CVE-2026-40227 published?
- CVE-2026-40227 was published on 2026-04-10 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:systemd_project:systemd:260:-:*:*:*:*:*:*
More vulnerabilities in Systemd Project Systemd
- CVE-2022-2526 — Critical (CVSS 9.8): A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and…
- CVE-2018-21029 — Critical (CVSS 9.8): systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name…
- CVE-2015-7510 — Critical (CVSS 9.8): Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
- CVE-2017-1000082 — Critical (CVSS 9.8): systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the…
- CVE-2018-15688 — High (CVSS 8.8): A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory…
- CVE-2023-26604 — High (CVSS 7.8): systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible…
All CVEs affecting Systemd Project Systemd →
Other CWE-1025 vulnerabilities
- CVE-2026-9800 — High (CVSS 8.1): A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all…
- CVE-2026-40880 — High (CVSS 8.1): ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a…
- CVE-2025-32464 — Medium (CVSS 6.8): HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow…
- CVE-2024-20342 — Medium (CVSS 5.8): Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine…
- CVE-2025-2888 — Medium (CVSS 4.5): During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when…
- CVE-2025-2887 — Medium (CVSS 4.5): During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to…