CVE-2026-40227
Medium · 6.2CVSS
6.2
EPSS
0.3%
Published
Apr 10, 2026
CISA due date
—
The record
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… CWE-1025
- CVE-2026-75840 ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM… CWE-1025
- CVE-2026-9800 A flaw was found in Keycloak Policy Enforcer. CWE-1025
- CVE-2026-48860 Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist… CWE-1025
- CVE-2026-40880 ZEBRA is a Zcash node written entirely in Rust. CWE-1025
- GHSA-xvj8-ph7x-65gf Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks CWE-1025
- CVE-2026-21691 iccDEV has Type Confusion in CIccTag:IsTypeCompressed() CWE-1025