This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-91840 →

DEBIAN-CVE-2026-91840

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline ch...

Original description

The description as published by the source.

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 network-manager-vpnc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 network-manager-vpnc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org