CVE-2025-12744 Abrt: command-injection in abrt leading to local privilege escalation
An unprivileged local user can inject shell commands into the ABRT daemon to execute arbitrary code and gain root privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12744?
CVE-2025-12744 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 6, published on 3 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.
Weakness: CWE-78
Which versions are affected by CVE-2025-12744?
Linux distribution packages (40)
abrt AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-addon-ccpp AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-addon-coredump-helper AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-addon-kerneloops AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-addon-pstoreoops AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-addon-vmcore AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-addon-xorg AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-cli AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-cli-ng AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-console-notification AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-dbus AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-desktop AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-gui AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-gui-libs AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-libs AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-plugin-machine-id AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-plugin-sosreport AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt-tui AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
python3-abrt AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
python3-abrt-addon AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
python3-abrt-container-addon AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
python3-abrt-doc AlmaLinux:8 | All versions | 2.10.9-25.el8_10.alma.1 |
abrt Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-ccpp Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-ccpp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-coredump-helper Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-coredump-helper-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-kerneloops Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-kerneloops-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-pstoreoops Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-pstoreoops-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-upload-watch-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-vmcore Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-xorg Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-addon-xorg-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-atomic-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-cli Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-cli-ng Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-console-notification Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
abrt-dbus Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.9-25.el8_10 |
How do I fix CVE-2025-12744?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-12744 being exploited?
There is no known exploitation of CVE-2025-12744 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2025:22760, GHSA-vwhf-x6j3-3qfg, RHSA-2025:22760, RHSA-2025:23030, RHSA-2025:23031, RHSA-2025:23032 and 2 more.