Local PrivEsc via System Group Addition in systemd-homed 245
CVE-2026-16742 Published on August 10, 2026

systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

NVD

Vulnerability Analysis

CVE-2026-16742 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Types

Improper Verification of Cryptographic Signature

The software does not verify, or incorrectly verifies, the cryptographic signature for data.

Improper Privilege Management

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.


Affected Versions

systemd-homed: