A flaw in the libblockdev library allows a label supplied by a caller to be passed directly as positional arguments to the ntfslabel and fatlabel utilities. Because there is no separator or validation for values that begin with a dash, a label starting with '-' can be interpreted as a command‑line flag by the spawned tool, which may bypass safety checks or trigger unintended operations. This is classified as CWE‑88. The primary impact is local command‑injection that can change system state or execute arbitrary options when an unprivileged local user sets a filesystem label through the udisks2 Filesystem.SetLabel D‑Bus method, without needing administrator authentication. The CVSS score of 3.3 reflects that the vulnerability is low severity but still relevant for local users.

The vulnerability affects the libblockdev component on Red Hat Enterprise Linux 10, 7, 8 and 9. Unprivileged local users in those distributions can trigger the flaw by invoking the udisks2 Filesystem.SetLabel D‑Bus method, which internally calls the failing bd_fs_ntfs_set_label and bd_fs_vfat_set_label functions.

The CVSS rating indicates a low severity (3.3), and the EPSS score is not available, implying the exploit probability is not quantified. The vulnerability is listed as not part of the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local, requiring a user with a shell or other means of requesting a setlabel operation via D‑Bus without admin rights. Because no privilege escalation is needed, any local user can exploit the injection, though the damage is limited to the effects of the injected command. Restricting the polkit policy so that org.freedesktop.udisks2.modify-device requires administrator authentication would reduce the attack surface, but it also affects normal desktop operations that change labels or UUIDs on user devices.