{"id":"CVE-2026-85498","kind":"vulnerability","aliases":["CVE-2026-85498"],"related":[],"title":"polkit: null-byte input causes out-of-bounds read and crash","description":"A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).","summary":"A bug in polkit's authentication agent helper mishandles input that starts with a null byte, causing an integer underflow and an out-of-bounds memory read. An attacker who can supply crafted input can crash the process, causing a denial of service.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","polkit"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T09:17:08+00:00","first_seen_at":"2026-10-29T09:23:58+00:00","triaged_at":"2026-10-29T09:24:36+00:00","updated_at":"2026-10-29T09:24:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-29T09:24:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"polkit: null-byte input causes out-of-bounds read and crash","impact":"low","summary":"A bug in polkit's authentication agent helper mishandles input that starts with a null byte, causing an integer underflow and an out-of-bounds memory read. An attacker who can supply crafted input can crash the process, causing a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["polkit","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Crafted input crashes the polkit helper process, causing denial of service.","analyst_note":"Check the NVD entry and the upstream polkit advisory for affected and fixed versions and the exact input path that reaches the helper.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running polkit with its authentication agent helper, typically Linux servers and desktops. The sources do not say which polkit versions are affected or which input path reaches the flaw, so the exposed set is unknown. Teams that do not run polkit's authentication agent helper are unlikely to be affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000644,"input_tokens":4119,"output_tokens":465,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-85498':16A,19A 'agent':29B,88C 'applic':121C 'arithmet':83C 'attack':52B,108C 'authent':28B,87C 'begin':77C 'bound':10A,48B,104C 'buffer':95C 'bug':24B 'byte':4A,38B,81C 'calcul':97C 'capabl':109C 'caus':6A,39B,62B,90C,119C 'craft':56B,112C 'crash':13A,59B,122C 'cve':14A,17A 'denial':64B,127C 'dos':130C 'error':84C 'flaw':68C,117C 'found':70C 'helper':30B,89C 'infrastructur':20B 'input':5A,32B,57B,75C,113C 'integ':41B,92C 'length':96C 'linux':21B 'memori':49B,105C 'mishandl':31B 'null':3A,37B,80C 'null-byt':2A 'out-of-bound':7A,45B,101C 'polkit':1A,22B,26B,72C 'potenti':118C 'process':61B,74C 'read':11A,50B,106C 'result':98C,124C 'servic':66B,129C 'start':34B 'suppli':55B,111C 'trigger':115C 'underflow':42B,93C","nicknames":[],"mitigations":[],"who_affected":"Systems running polkit with its authentication agent helper, typically Linux servers and desktops. The sources do not say which polkit versions are affected or which input path reaches the flaw, so the exposed set is unknown. Teams that do not run polkit's authentication agent helper are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85498","severity":null,"published_at":"2026-10-29T09:17:08+00:00","modified_at":"2026-10-29T09:17:08+00:00","first_seen_at":"2026-10-29T09:23:58+00:00","fetched_at":"2026-10-29T09:23:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}