The vulnerability arises because sdbootutil invokes qrencode twice, passing the private PIN or recovery key as part of the command line arguments. These arguments are then written to /proc/<pid>/cmdline, where any unprivileged local user can read the file and capture the secret. The result is a clear disclosure of confidential information that could be used to compromise account recovery or unlock encrypted partitions.

SUSE Linux Enterprise Server 16.1, SUSE Linux Enterprise Server for NVIDIA 16.1, openSUSE Leap 16.1, and openSUSE Tumbleweed are all affected. The vulnerability is tied to the sdbootutil component bundled with these distributions.

The moderate CVSS score of 5.9 reflects that the attack is local and requires only routine access to the filesystem, but the secret leakage is severe. The EPSS score of less than 1% indicates a low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. Nonetheless, any local attacker can trivially read the leaked credentials, so the risk to confidentiality is significant for systems that rely on PIN or recovery key protection.