CVE-2015-3246 Exploited in the wild

Red Hat Libuser Race Condition Vulnerability

Risk score: 79/100
CVSS: 7.4 v3.1
Published: 11 Aug 2015
Added to CISA's exploited list: 26 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: A race condition vulnerability in libuser, used in the userhelper program, allows local users to cause a denial of service by causing an error during modification of /etc/passwd. This vulnerability can be combined with CVE-2015-3245 to gain privileges.
Affected: {'products': ['Red Hat Enterprise Linux'], 'packages': ['libuser', 'usermode'], 'versions': ['libuser before 0.56.13-8', 'libuser before 0.60 before 0.60-7']}
Fix: Apply mitigations in accordance with vendor instructions
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Red Hat Libuser: Amber, patch this week. A race condition vulnerability in libuser, used in the userhelper program, allows local users to cause a denial of service by causing an error during modification of /etc/passwd. This vulnerability can be combined with CVE-2015-3245 to gain privileges.

The flaws

CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability (CVSS 7.4 · exploited)

The fix

Upgrade Red Hat Libuser: 0.56.13 · 0.60 or later on your release line

Who is exposed: {'products': ['Red Hat Enterprise Linux'], 'packages': ['libuser', 'usermode'], 'versions': ['libuser before 0.56.13-8', 'libuser before 0.60 before 0.60-7']}

Where it stands

Exploited in the wild
On CISA's exploited list since 26 Aug
US federal deadline 9 Sep

How it unfolded

26 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
9 Sep, Deadline (official): US federal agencies must have patched
3 Nov, Ubuntu security notices (official): USN-8987-1: libuser vulnerabilities

Connects to

Same weakness: CWE-264 (CWE-264). 5 other warnings in 30 days

Why it is Amber

CVSS 7.4 high
Exploited in the wild (CISA KEV)
Public exploit or proof of concept referenced
Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

USN-8987-1: libuser vulnerabilities

References

Original description

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

Last activity 3 Nov 2026. Patch Forecast updates every hour.