CVE-2026-40223
Medium · 4.7CVSS
4.7
EPSS
0.1%
Published
Apr 10, 2026
CISA due date
—
The record
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-59305 Partition interceptor may be improperly added while sending message. CWE-696
- CVE-2026-68930 Russh is a Rust SSH client & server library. CWE-696
- CVE-2026-67217 cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in… CWE-696
- CVE-2026-56355 GNU Savannah Administration Savane through 3.17 uses untrusted data as part of… CWE-696
- CVE-2026-49317 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696
- CVE-2026-49318 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696
- CVE-2026-44919 In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop… CWE-696
- CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. CWE-696