PT-2026-63318 · Canonical · Accountsservice

CVE-2026-61897 · Published 2026-07-21 · Updated 2026-07-21

OSV

USN-8580-1 fixed vulnerabilities in AccountsService. This update provides the corresponding fixes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly handled dropping privileges. A local attacker could use this issue to execute arbitrary commands as an administrator. (CVE-2026-61897)

It was discovered that the Ubuntu-specific SetLanguage helpers for AccountsService incorrectly handled parsing configuration files. A local attacker could use this issue to execute arbitrary commands. (CVE-2026-61898)

Related Identifiers

CVE-2026-61897

USN-8580-1

USN-8580-2

Affected Products

Accountsservice

References · 8

• https://osv.dev/vulnerability/USN-8580-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-61898 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8580-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8580-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8580-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-61897 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-61897 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-61897 · Vendor Advisory