The flaw resides in polkit’s authentication agent helper. When it processes an input that begins with a null byte, a calculation of the buffer length incorrectly uses an unsigned integer, causing an underflow. The resulting out‑of‑bounds memory read can be triggered by an attacker who supplies crafted input. The effect is an application crash that can lead to a denial of service. This is a stack buffer underflow, classified as CWE‑125, limiting the impact primarily to availability rather than confidentiality or integrity.

Polkit is a component commonly bundled with many Linux distributions. In Red Hat ecosystems, this regression affects the polkit packages in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as in Red Hat Hardened Images and Red Hat OpenShift Container Platform 4. The CVE data does not list specific versions, so user systems should confirm whether their polkit installation corresponds to a vulnerable release that includes the regression, and compare against the latest Red Hat updates that apply the original read_cookie() fix.

The CVSS score of 3.5 indicates a low overall risk, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is unavailable, so the probability of exploitation is unclear. The flaw occurs in the polkit authentication agent, a privileged user‑space component that processes cookie data. An attacker capable of supplying crafted input—such as through a null‑byte prefixed cookie—can trigger the integer underflow, causing an out‑of‑bounds read and a crash that results in denial of service. Because the vulnerable code is reachable only by a local or adjacent low‑privileged interacting with the polkit authentication agent, the attack surface is limited. No public exploitation evidence exists, so the risk remains modest but warrants monitoring and version review.