CVE-2015-3246 Red Hat Libuser Race Condition
Local attackers can cause denial of service via inconsistent file state in /etc/passwd, potentially leading to privilege escalation when combined with another vulnerability.
- Exploited in the wild
- Since 26 Aug 2026
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3246?
CVE-2015-3246 is a high-severity vulnerability in Opensuse Opensuse, published on 11 Aug 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Which versions are affected by CVE-2015-3246?
It affects 3 products.
Products include Libuser Project Libuser, Opensuse Opensuse, Redhat Enterprise Linux.
How do I fix CVE-2015-3246?
Apply the vendor's patch. US federal agencies must fix it by 9 Sep 2026.
Is CVE-2015-3246 being exploited?
Yes. Attackers have exploited CVE-2015-3246 in the wild since at least 26 Aug 2026.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2015-3246, GHSA-f52h-j689-x786, UBUNTU-CVE-2015-3246.