Systemd
60 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Systemd, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Systemd CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 6 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 60 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High18
- Medium31
- Low7
Latest CVEs
The 15 most recently published vulnerabilities affecting Systemd.
- CVE-2026-40228In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.2.9
- CVE-2026-40227In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.6.2
- CVE-2026-40226In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.6.4
- CVE-2026-40225In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.6.4
- CVE-2026-40224In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.6.7
- CVE-2026-40223In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.4.7
- CVE-2026-29111systemd: Local unprivileged user can trigger an assert5.5
- CVE-2025-4598Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump4.7
- CVE-2023-7008Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes5.9
- CVE-2023-31438An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vend...5.3
- CVE-2023-31437An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "...5.3
- CVE-2023-31439An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite mod...5.3
- CVE-2023-26604systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specific...7.8
- CVE-2022-4415A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.5.5
- CVE-2022-45873systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation...5.5
Product grouping is registry-driven, with AI assist and human review. How it works