CVE-2025-5791 Users: `root` appended to group listings
A flaw in the Rust users crate allows privilege escalation by incorrectly appending the root group to access lists for users with fewer than 1024 groups.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5791?
CVE-2025-5791 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 6 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Weakness: CWE-266
Which versions are affected by CVE-2025-5791?
3 open source packages ship an affected version, including users.
| Package | Affected | Fixed in |
|---|---|---|
users crates.io | From 0.8.0 | None |
users crates.io | From 0.8.0 to 0.11.0 | None |
users crates.io | From 0.8.0 to 0.11.0 | None |
Linux distribution packages (6)
afterburn SUSE:Linux Micro 6.0 | All versions | 5.9.0.git21.a73f509-1.1 |
afterburn SUSE:Linux Micro 6.1 | All versions | 5.9.0.git21.a73f509-slfo.1.1_1.1 |
afterburn openSUSE:Tumbleweed | All versions | 5.8.2-3.1 |
agama openSUSE:Tumbleweed | All versions | 17+60.68fdb92ec-26.1 |
lsd openSUSE:Tumbleweed | All versions | 1.2.0-1.1 |
mirrorsorcerer openSUSE:Tumbleweed | All versions | 0.1.3~1-1.1 |
How do I fix CVE-2025-5791?
Upgrade to a fixed version.
Is CVE-2025-5791 being exploited?
There is no known exploitation of CVE-2025-5791 in the wild and no public exploit code.
Sources
Also known as AZL-63771, AZL-63848, GHSA-m65q-v92h-cm7q, RUSTSEC-2025-0040, SUSE-RU-2025:20961-1, SUSE-RU-2025:21046-1 and 5 more.