An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It sets the effective UID/GID to the target user while leaving the real UID as 0 (root). A shell spawned by a helper script therefore inherits a real UID of 0 and can reset its effective UID to root, enabling local privilege escalation.

Canonical AccountsService packages prior to version 23.13.9-8ubuntu7 on Ubuntu are affected. The vulnerability exists only in the Ubuntu-specific patch to AccountsService and does not appear in the upstream or other distributions' versions.

The CVSS score of 7.8 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, as an authenticated or local user on the system can trigger the language helper scripts. Once the scripts are invoked, the implied privilege escalation path involves the spawn of a shell that can reset its effective UID to root because of the preserved real UID. Successful exploitation would grant the attacker full root privileges on the affected machine.