The vulnerability allows an on‑path attacker who can interpose in HTTP traffic between an APT client and its archive server to force the client to install an attacker‑controlled, unverified package, which in turn grants remote code execution with root privileges. It is triggered by the reuse of hard links during package downloads, a classic race‑condition flaw (CWE‑367) that enables arbitrary file content replacement, and also involves improper handling of input that can be modelled as an injection weakness (CWE‑62). The flaw requires the client to follow redirects and retry the download of package files. This flaw is only exploitable when the client’s Acquire::Retries configuration is non‑zero, which is the default (value 3) for Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish); earlier releases are unaffected by the default configuration.

Affected products are the APT client component in Debian and Ubuntu Linux distributions. The default configuration that makes the flaw exploitable applies to Debian 12 and newer releases, as well as Ubuntu 22.04 LTS and newer. No specific package or version numbers are listed, but the vulnerability affects any installation that uses the default Acquire::Retries setting of 3.

The CVSS score of 7.7 categorises the flaw as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of a widespread exploitation is uncertain, though the ability to gain root privileges is a critical impact. An attacker needs to control the network path between the APT client and its archive server (for example, by running a malicious mirror or proxy) and the APT client must be configured to retry downloads. Because the vulnerability relies on hard‑link reuse, typical mitigations like disabling redirection retries or ensuring that only trusted mirrors are used can reduce the attack surface.