CVE-2025-53391

CRITICAL EPSS 4.3%
Published Jun 28, 20251y ago · Modified Jun 17, 20261w ago
9.3 CVSS 3.1
Critical
Find Similar
Published Jun 28, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active settings that allow a local user to escalate their privileges to root.

CVSS Details

Base Score
9.3
Exploitability
2.5
Impact
6.0
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
4.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

References 4

  • bugs.debian.org https://bugs.debian.org/1108288
  • bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108288
  • deb.debian.org https://deb.debian.org/debian/pool/main/z/zulucrypt/zulucrypt_6.2.0-1.dsc
  • salsa.debian.org https://salsa.debian.org/debian/zulucrypt/-/blob/9d661c9f384c4d889d3387944e14ac70cfb9684b/debian/patches/fix_zulupolkit_policy.patch

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.