{"id":"CVE-2025-7519","details":"A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.","modified":"2026-04-10T05:37:03.083652Z","published":"2025-07-14T14:15:25.593Z","related":["SUSE-SU-2025:02525-1","SUSE-SU-2025:02527-1","SUSE-SU-2025:02528-1","SUSE-SU-2025:20559-1","SUSE-SU-2025:20662-1","openSUSE-SU-2026:10453-1"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-7519"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379675"},{"type":"FIX","url":"https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245"},{"type":"FIX","url":"https://github.com/polkit-org/polkit/pull/570"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/polkit-org/polkit","events":[{"introduced":"0"},{"fixed":"107d3801361b9f9084f78710178e683391f1d245"}]}],"versions":["0.100","0.101","0.102","0.103","0.104","0.105","0.106","0.107","0.108","0.109","0.110","0.111","0.112","0.113","0.114","0.115","0.116","0.117","0.118","0.119","0.120","0.91","0.92","0.93","0.94","0.95","0.96","0.97","0.98","0.99","121","122","123","124","125","126","POLICY_KIT_0_3","POLICY_KIT_0_4","POLICY_KIT_0_5","POLICY_KIT_0_6","POLICY_KIT_0_7","POLICY_KIT_0_8","POLICY_KIT_0_9","start"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-7519.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"4.0"}]},{"events":[{"introduced":"0"},{"last_affected":"6.0"}]},{"events":[{"introduced":"0"},{"last_affected":"7.0"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]},{"events":[{"introduced":"0"},{"last_affected":"10.0"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}