An improper privilege management flaw in apport before version 2.37.0 allows an unprivileged local user to execute code as root. The automatic crash report pipeline runs as root and invokes the system ldd on the attacker‐controlled ExecutablePath field of a crash file located in the world‑writable /var/crash directory. This causes the dynamic loader to load and execute an attacker‑supplied audit module that is referenced by the ELF DT_AUDIT tag, resulting in arbitrary root‑privileged code execution and full system compromise.

The vulnerability affects Canonical’s apport component on systems that have automatic crash reporting enabled. All versions prior to 2.37.0 are susceptible, regardless of the specific Ubuntu release, because the crash report processor runs with root privileges and does not validate the ExecutablePath field.

The CVSS score of 7.3 indicates a high severity of the flaw, while the EPSS score is not available and there is no listing in CISA’s KEV catalog, suggesting the vulnerability is known but exploitation has not been observed at scale. The likely attack vector is local: an attacker must be able to write a crash file into /var/crash and trigger the automatic processing, which often occurs on system startup. Given the root execution path, the risk to affected systems is significant, demanding immediate mitigation.