A flaw in systemd allows a local, unprivileged user to register a machine with an invalid class value through the RegisterMachine D‑Bus method. Because the class parameter is not properly validated, the attacker can create a machine object that remains accessible. Based on the description, the attacker can then invoke privileged methods on that object, leading to execution of arbitrary commands with root privileges on the host system.

The vulnerability affects Red Hat products that ship systemd, including Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. No specific affected systemd releases are enumerated, so the issue applies to the default systemd packages supplied in these distributions.

The CVSS score of 6.7 indicates moderate severity, and the EPSS score of under 1 % suggests a low likelihood of exploitation. The attack requires local, non‑root user access and interaction with the D‑Bus interface; no publicly available exploit code has been documented, and the vulnerability is not listed in CISA's KEV catalog. The likely vector is local privilege escalation via the RegisterMachine method, after which the attacker achieves full system privileges.