{"id":"redhat-libuser-race-cve-2015-3246-aug-2026","category":"patch","status":"closed","title":"Red Hat libuser race condition CVE-2015-3246 added to CISA's exploited list; RHEL 6 and 7 fixed, RHEL 5 not","tldr":"A 2015 flaw in Red Hat's libuser (CVE-2015-3246) is now on CISA's exploited list. A local user can corrupt /etc/passwd and gain root. Fixed in RHEL 6 and 7 updates; RHEL 5 has no fix. Server admins should confirm libuser is updated.","summary":"CISA added CVE-2015-3246 to its list of flaws being used in attacks on 26 August 2026. The flaw is in libuser, a Red Hat library that manages user accounts. It edited the /etc/passwd file in place instead of writing a safe copy and swapping it in, so an interrupted or failed update could leave the file corrupted. A person who already has a login on the machine could use that to crash it or gain full (root) control. Red Hat rates it Important, and the CVE record carries a CVSS score of 7.4. Red Hat says all libuser versions in Red Hat Enterprise Linux (RHEL) 6 and 7 were affected and fixed through RHSA-2015:1482 (RHEL 6) and RHSA-2015:1483 (RHEL 7). RHEL 5 is also affected, but Red Hat says no fix is planned. Container, cloud and appliance images based on these releases can carry the vulnerable library. Red Hat's page does not describe the attacks, and CISA's listing does not say who is exploiting it. This mainly concerns servers and shared systems, not home devices.","action":"Administrators of Red Hat Enterprise Linux 6 or 7 systems, and images or containers built from them, should apply the libuser update from Red Hat. For RHEL 5, which has no fix, retire or isolate the system, or use Red Hat's PAM workaround on the chfn and chsh services.","product":"Red Hat libuser (Red Hat Enterprise Linux 5, 6 and 7)","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2015-3246"],"tags":["red-hat","rhel","libuser","linux","privilege-escalation","cisa-kev","race-condition"],"affected":["All libuser versions in Red Hat Enterprise Linux 6 and 7","Red Hat Enterprise Linux 5 (no fix planned)","Official Red Hat container, Atomic Host, cloud and appliance images and AWS AMIs containing vulnerable libuser","RHEV-H images (fix planned for a future update)"],"fixed":["RHSA-2015:1482 (RHEL 6)","RHSA-2015:1483 (RHEL 7)"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2015-3246 libuser race condition (Red Hat)","url":"https://access.redhat.com/articles/1537873","by":"Red Hat","date":"2015-07-24"},{"kind":"news","title":"CVE-2015-3246 patch status and CISA KEV listing","url":"https://isitpatched.com/cve/CVE-2015-3246","by":"isitpatched.com","date":"2026-08-26"}],"started":"2026-08-26","closed":"2026-08-26","created":"2026-11-03T22:09:55.445Z","updated":"2026-11-03T22:09:55.445Z","cve_notes":[{"cve":"CVE-2015-3246","name":"Race condition in Red Hat libuser editing /etc/passwd","what":"libuser edited the /etc/passwd account file directly instead of writing a temporary copy and renaming it, so a local user with a login could corrupt the file to crash the system or gain root control.","severity":"high","cvss":7.4}],"timeline":[{"at":"2026-08-26","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added CVE-2015-3246 to its Known Exploited Vulnerabilities list, with a federal agency remediation deadline reported as 2026-09-09. The listing does not say who is exploiting it or how widely.","url":"https://isitpatched.com/cve/CVE-2015-3246","by":"isitpatched.com","patch":null},{"at":"2015-07-24","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"Red Hat's article on CVE-2015-3246 (last updated this date) explains that libuser edited /etc/passwd in place, so a failed update could leave it corrupted. It rates the flaw Important and points to fixes for RHEL 6 (RHSA-2015:1482) and RHEL 7 (RHSA-2015:1483). RHEL 5 is affected but has no fix planned.","url":"https://access.redhat.com/articles/1537873","by":"Red Hat","patch":"partial"}],"url":"https://hard.fyi/live/redhat-libuser-race-cve-2015-3246-aug-2026/","json":"https://hard.fyi/api/live?id=redhat-libuser-race-cve-2015-3246-aug-2026"}