Is CVE-2026-41054 actively exploited?

No active exploitation of CVE-2026-41054 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41054 be exploited remotely?

No. CVE-2026-41054 requires local access to exploit.

What is the CVSS score of CVE-2026-41054?

CVE-2026-41054 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-41054

HIGH

CVE-2026-41054

CWE-305Published: May 20, 2026· Updated: May 22, 2026

7.8

CVSS v3.1

EPSS:0.00%probability of exploitation in 30 daysPercentile:0.2th

Official Description

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

NVD Source

Technical Analysis

CVE-2026-41054 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.