CVE-2015-3246

On Linux, libuser helps manage system user accounts. This bug can be triggered by a local user (someone with an account on the machine) while a user-account change is happening, causing the system’s user account list to become inconsistent. That can lead to the system being unable to manage accounts properly and can disrupt logins and account operations until the system is fixed.

This matters if you run an affected Linux distribution that uses libuser (notably Red Hat Enterprise Linux or openSUSE) and your systems allow local users to log in. You should treat it as a real risk because it’s in CISA’s Known Exploited Vulnerabilities list. The reachability gate here is local access: an attacker must already be able to run on the machine (local user access) to trigger the faulty update behavior.

This is a RED issue because it has confirmed real-world exploitation and is listed in CISA KEV. Attackers don’t need a password or special trick beyond having local access and triggering an error during a user/account change, which can cause account-management disruption. Act now by updating to the fixed libuser version.

Confirm exposure

• On each affected server, identify the installed libuser package version (example approach: check your package manager for the libuser version).
• Compare your version to the fixed release: libuser fixed in 0.56.13-8.

Upgrade / remediation

• Upgrade libuser to 0.56.13-8 or later (use your distribution’s supported update channels).
• Ensure the update includes the vendor errata referenced for the affected distros (see vendor remediation links in your internal ticket).

Verification after patch

• Confirm that account management operations succeed (for example, create/update/remove a test user via the normal workflow used in your environment).
• Watch system logs for errors related to user/account updates that would indicate the inconsistent /etc/passwd state problem is still present.

If patching is delayed

• Follow your OS vendor’s stated workaround/mitigation guidance for the issue while you schedule the upgrade.

Timing

• CISA KEV remediation due date: 2026-09-09.

What to monitor

• Repeated failures or errors during user/account modification tasks.
• Any evidence of /etc/passwd inconsistency or account-management tool crashes during normal operations.

CVE-2015-3246 is a local denial-of-service via inconsistent modification of the system user database file (/etc/passwd) when libuser’s userhelper updates are interrupted by an error during the change process. The weakness is associated with CWE-264 (Permissions Issues) and CWE-367 (TOCTOU Race Condition / error-state behavior in the modification flow as described by cataloged impacts), resulting in corrupted or inconsistent account list state and broken account management.

Exposure/exploitation status: Listed in CISA KEV (added 2026-08-26) with CISA due date 2026-09-09, and exploitation reporting is marked as YES with public exploit availability.

Fix: libuser is fixed in 0.56.13-8 (and corresponding distribution fix paths as per vendor errata).

Prediction: EPSS is provided in the source material, but public prioritization should follow KEV-confirmed exploitation rather than rely on prediction values.

Note on chaining: The provided description mentions this can be combined with CVE-2015-3245 to gain privileges; however, only the DoS/inconsistent state behavior is explicitly supported by the findings above.