Systemd

Vendor:

First CVE: Oct 3, 2013 · Active for 12 years

55
Total CVEs
More Total CVEs than 98% of tracked products
4.6
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
6.4
Avg CVSS
Higher Avg CVSS than 27% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Systemd over time

Volume of CVEsAvg CVSS Base Score
First CVE
Oct 3, 2013
12 years ago
Most Recent CVE
Apr 10, 2026
105 days ago

CVE Severity & Scoring

Systemd55 CVEs
All CVEs352,294 CVEs
LowMediumHighCritical
Attack Vector
Local33 (60.0%)
Network12 (21.8%)
Unknown5 (9.1%)
Physical3 (5.5%)
Adjacent Network2 (3.6%)
Attack Complexity
Low40 (72.7%)
High10 (18.2%)
Unknown5 (9.1%)
User Interaction
None46 (83.6%)
Unknown5 (9.1%)
Required4 (7.3%)
Privileges Required
Low32 (58.2%)
High1 (1.8%)
None17 (30.9%)
Unknown5 (9.1%)

Top CVEs

Signals from CVEs in this product scope (55 CVEs).

55 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server can exploit this via a
Jun 28, 20177.556NONO
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence s
Oct 26, 20187.838NOYES
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function
Oct 26, 20177.537NONO
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by
Apr 26, 20197.836NOYES
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the s
Apr 26, 20197.836NOYES
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows lo
Jan 29, 20187.835NOYES
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in som
Apr 9, 20197.034NOYES
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user inte
Jul 7, 20179.834NONO
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and inc
Oct 26, 20187.033NOYES
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their pri
Jan 23, 20177.833NOYES

Exploit Exposure

Signals from CVEs in this product scope (55 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
7 CVEs
12.7% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (55 CVEs).

Media Mentions

Signals from CVEs in this product scope (55 CVEs).

Top CNAs Publishing CVEs For Systemd

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
916.30.4%00
816.30.4%00
716.30.4%00
616.30.4%00
516.30.4%00
416.30.4%00
3715.50.4%00
3616.30.4%00
3516.30.4%00
3416.30.4%00
3316.30.4%00
3216.30.4%00
3116.30.4%00
3016.30.4%00
316.30.4%00
2916.30.4%00
2816.30.4%00
2716.30.4%00
26015.50.2%00
2616.30.4%00