CVE-2026-40227

CVE-2026-40227 is a denial-of-service vulnerability affecting systemd versions 260 and earlier, where a local unprivileged user can crash the service by sending a specially crafted IPC API call containing an array or map with a null element. The flaw allows attackers with basic local access to trigger an assertion failure in the systemd daemon. The vulnerability carries a CVSS score of 5.5 (MEDIUM) with a local attack vector and low complexity, requiring only user-level privileges and no user interaction to exploit. The impact is limited to availability disruption with no confidentiality or integrity concerns, as the attacker can only cause a denial of service. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities list. The EPSS score of 0.0002 indicates minimal real-world exploitation probability, and community attention remains low, suggesting this remains primarily a theoretical risk requiring patching as part of routine maintenance updates.