CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege Escalation
CVE-2015-5287 is a local privilege-escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT): the kernel-invoked coredump helper mishandles symbolic links when writing crash dumps to a predictable path under /var/spool/abrt, so a local attacker with write access to an ABRT problem directory can plant a symlink and have root-owned code write to a file of their choosing, escalating privileges. CISA added it to the KEV catalog in 2026 even though the affected package is more than a decade old and end-of-life on its original release.
Vulnerability summary
| Vulnerability ID | CVE-2015-5287 |
|---|---|
| CVSS score | 7.8 |
| EPSS score | 0.05003 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2015-12-07T18:59:02.230 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Red Hat Automatic Bug Reporting Tool (ABRT) | cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:* | before 2.7.1 on Red Hat Enterprise Linux 7 / Oracle Linux 7 (fixed by abrt-0:2.1.11-35.el7 and libreport-0:2.1.11-31.el7 per RHSA-2015:2505); Red Hat Enterprise Linux 6 not affected |
What this means
CVE-2015-5287 is an improper link resolution before file access vulnerability (CWE-59, "link following"/symlink attack) in the Automatic Bug Reporting Tool (ABRT), the crash-reporting daemon shipped on several Red Hat Enterprise Linux releases. NVD's description states: "The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump" (NVD).
NVD's own analysis gives CVSS v3.1 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, low complexity, low privileges required, full compromise of confidentiality/integrity/availability; this is both the NVD Primary and the independently-submitted Secondary score, so the two agree (NVD).
Red Hat's own security-data record explains the root cause: "It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps of ABRT programs to the ABRT dump directory (/var/spool/abrt). A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges." Red Hat shipped the fix in Red Hat Enterprise Linux 7 via advisory RHSA-2015:2505 (2015-11-23), updating packages abrt-0:2.1.11-35.el7 and libreport-0:2.1.11-31.el7; Red Hat Enterprise Linux 6 is explicitly recorded as "Not affected." Red Hat credits Philip Pettersson of Samsung for reporting the issue (Red Hat Security Data API, CVE-2015-5287; RHSA-2015:2505).
CISA added CVE-2015-5287 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26 (catalog version 2026.10.28, 1762 entries, confirmed live this run), with a required-action due date of 2026-09-09 and a note that "the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS)," advising organizations still running an unpatched, unsupported ABRT build to discontinue use rather than expect further vendor patches. The catalog does not record known ransomware-campaign use, and this is a local (not remote) privilege-escalation primitive — its KEV listing most plausibly reflects use as a post-compromise escalation step rather than an initial-access vector (CISA KEV).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.05003 (92.207th percentile) — modest in absolute terms, consistent with a local-only privilege-escalation bug rather than a mass-exploited remote flaw, but still elevated relative to most scored CVEs (FIRST EPSS).
Any system still running ABRT before 2.1.11-35.el7 on RHEL 7 or an equivalent Oracle Linux 7 build should apply the RHSA-2015:2505 update; RHEL 6 hosts are unaffected per Red Hat's own package-state data.
Evidence
- The ABRT coredump helper mishandles symlinks when writing core dumps to a predictable path, letting a local attacker with write access to a problem directory escalate privileges. — NVD
- NVD Primary CVSS v3.1 base score is 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, matching the independently-submitted Secondary score. — NVD
- Fixed in Red Hat Enterprise Linux 7 via RHSA-2015:2505 (abrt-0:2.1.11-35.el7, libreport-0:2.1.11-31.el7); Red Hat Enterprise Linux 6 is not affected; reported by Philip Pettersson (Samsung). — Red Hat Security Data API / RHSA-2015:2505
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-26, required-action due date 2026-09-09, flagged as possibly end-of-life/end-of-service (catalog version 2026.10.28, 1762 entries, confirmed live this run). — CISA KEV
- EPSS score is 0.05003 (92.207th percentile) as of 2026-10-28. — FIRST EPSS