CVE-2015-3246

CVE-2015-3246 is a race condition in Red Hat's libuser, the user-management library used by utilities that modify system accounts, that can cause corruption of the /etc/passwd file during concurrent account updates. An authenticated local user who triggers the race — typically by racing account-modification operations against one another — can desynchronize or corrupt the passwd file. Successful exploitation yields either a denial-of-service condition on the host or, in the privilege-escalation case, elevated (root-level) access by manipulating entries in /etc/passwd. Any Red Hat system shipping the vulnerable libuser library is affected, with risk concentrated on multi-user servers where untrusted local accounts exist. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, indicating it is being exploited in the wild, and EPSS assigns it an 8.8% probability of exploitation within 30 days (95th percentile); ransomware use is unknown and no public proof-of-concept is cataloged.

What to do: Update libuser to the fixed packages provided in Red Hat's security advisories across all RHEL/Fedora systems, prioritizing multi-user servers and any asset with untrusted local accounts, in line with CISA BOD 26-04 requirements (apply vendor mitigations or discontinue use of the product where mitigation is unavailable). Because exploitation requires local credentials, review which systems expose local login to non-administrators and check the integrity of /etc/passwd for signs of tampering. Confirm the patched library is active after update and monitor for further KEV-driven deadlines.