Ubuntu 26.04 AccountsService Important Local Exec Threat CVE-2026-61897

ubuntu

July 21, 2026

AccountsService could be made to run programs as an administrator if it opened a specially crafted file.

Summary

AccountsService could be made to run programs as an administrator if it

opened a specially crafted file.

Software Description:

- accountsservice: query and manipulate user account information

Details:

It was discovered that the Ubuntu-specific SetLanguage patch to

AccountsService incorrectly handled dropping privileges. A local attacker

could use this issue to execute arbitrary commands as an administrator.

(CVE-2026-61897)

It was discovered that the Ubuntu-specific SetLanguage helpers for

AccountsService incorrectly handled parsing configuration files. A local

attacker could use this issue to execute arbitrary commands.

(CVE-2026-61898)

Topics Covered

security advisory Ubuntu important local attack arbitrary execution accountsservice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  accountsservice                 23.13.9-8ubuntu5.2
  libaccountsservice0             23.13.9-8ubuntu5.2

Ubuntu 24.04 LTS
  accountsservice                 23.13.9-2ubuntu6.1
  libaccountsservice0             23.13.9-2ubuntu6.1

Ubuntu 22.04 LTS
  accountsservice                 22.07.5-2ubuntu1.6
  libaccountsservice0             22.07.5-2ubuntu1.6

After a standard system update you need to reboot your computer to make
all the necessary changes.