CVE-2025-4598
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Key facts
- CVSS score
- 4.7 (v3.1)
- Severity
- MEDIUM
- CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
- CWE-364
- EPSS score
- 1.2% (68th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2025-16486)
- Published
- May 30, 2025
- NVD last modified
- September 1, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2025-16486 in the EU Vulnerability Database. Last updated in EUVD on October 15, 2026.
View on the EU Vulnerability DatabaseAffected products
- debian / debian linux
- debian / debian linux
- linux / linux kernel
- oracle / linux
- oracle / linux
- redhat / enterprise linux
- redhat / enterprise linux
- redhat / enterprise linux
- redhat / enterprise linux
- redhat / openshift container platform
- systemd project / systemd
Certified products that may be affected
44 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
- Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
- Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
- Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
- Oracle Linux 9 NSS Cryptographic Module - Oracle Corporation - FIPS 140 5339 - active
See all 44 in the Security Certifications Explorer.
References
- http://seclists.org/fulldisclosure/2025/Jun/9
- http://www.openwall.com/lists/oss-security/2025/06/05/1(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/06/05/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2025/08/18/3
- https://access.redhat.com/errata/RHSA-2025:22660
- https://access.redhat.com/errata/RHSA-2025:22868
- https://access.redhat.com/errata/RHSA-2025:23227
- https://access.redhat.com/errata/RHSA-2025:23234
- https://access.redhat.com/errata/RHSA-2026:0414
- https://access.redhat.com/errata/RHSA-2026:1652
- https://access.redhat.com/errata/RHSA-2026:18153
- https://access.redhat.com/security/cve/CVE-2025-4598(Vendor Advisory)
- https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598(Exploit, Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2369242(Issue Tracking)
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/(Exploit, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html
- https://www.openwall.com/lists/oss-security/2025/05/29/3(Mailing List)
- https://www.openwall.com/lists/oss-security/2025/08/18/3(Mailing List, Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain