CVE-2026-77113: Apport 0 to before 2.36.0, 0 to before 2.34.2, 0 to before 2.28.4

Affected technology

Apport · 0 to before 2.36.0, 0 to before 2.34.2, 0 to before 2.28.4
Canonical

Description’s affected range: before 2.36.0, 2.34.2, and 2.28.4 on Linux

Component: Not specified by the source
File: problem_report.py

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Active user interaction

What an attacker can do

An attacker can create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files. Vendor/CNA’s CVSS 4.0 assessment (base score 6.7/10) rates confidentiality and availability impact as none; integrity impact as high.