CVE-2018-15686
systemd: line splitting via fgets() allows for state injection during daemon-reexec
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 26, 2018
Updated · November 21, 2025
Description
It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 3.6CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-20 · Improper Input Validation