CVE WatchAug 15, 2026

CVE-2021-4034

Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

CVSS

7.8

High

EPSS

94.9%

p100

KEV

YES

Jun 27, 2022

Exploit Today

0-100

Published: Jan 28, 2022 · Last modified: Aug 15, 2026 · CWE-787 · CWE-125

EPSS · 30d

94.3%EPSS · 30 days94.9%

2026-09-162026-10-14

KEV catalog record

Product

Red Hat / Polkit

Vulnerability

Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

Added to KEV

Jun 27, 2022

Remediate by

Jul 18, 2022

Known ransomware use

Yes

Summary description

The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-4034

Technical description

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-58100—

—

———kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.6h CVE-2026-58098—

—

———When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.6h CVE-2026-101307—

—

———When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.6h CVE-2026-766675.7 MED

—

———A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.8h CVE-2026-766664.7 MED

—

———A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.8h CVE-2026-766657.1 HIG

—

———A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.8h