CVE-2025-12744
Published: 03 December 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-12744 is a command injection vulnerability (CWE-78) in the ABRT daemon's handling of user-supplied mount information. The daemon copies up to 12 characters from untrusted input and inserts them directly into a shell command ("docker inspect %s") without proper validation. This flaw affects the ABRT component, primarily in Red Hat environments, and carries a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). It was published on 2025-12-03.
An unprivileged local user can exploit the vulnerability by crafting a payload containing shell metacharacters. When processed, this injects arbitrary commands into the root-running ABRT process, enabling execution of attacker-controlled code and full root privilege escalation.
Mitigation details are available in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2025-12744 and the related Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2412467.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a command injection flaw in a root-running daemon (ABRT), directly enabling exploitation for local privilege escalation from unprivileged user to root.