A flaw in NetworkManager-vpnc enables a local unprivileged user to inject a newline character into the VPN username field. When the malicious VPN connection is activated, the injected newline corrupts the vpnc configuration, allowing the attacker to execute an arbitrary program with root privileges. This elevates the user’s access level from unprivileged to full system control, permitting any action an administrator could normally perform, including installation of software, modification of system files, and persistence mechanisms.

General‑purpose Linux systems that ship the GNOME NetworkManager‑vpnc package. All released versions of the NetworkManager‑vpnc component are impacted, as no specific version ranges have been isolated. Any distribution that includes NetworkManager‑vpnc without a subsequent upstream fix is vulnerable, regardless of how the VPN client is invoked.

The vulnerability has a CVSS score of 7.8, indicating high severity, and it is exploitable locally with no authentication. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers require only local access and no additional credentials; once the vpn connection is established, the privilege escalation occurs immediately. Because the escalation is local, it is suitable for targeted attacks against multi‑user environments or shared workstations.