Quick answers
- Is CVE-2026-64666 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-64666 being exploited in the wild.
- How severe is CVE-2026-64666?
- High severity, with a CVSS score of 7.1, published 11 November 2026.
- Which products and versions are affected?
- Mcdope Pam Usb 0.9.2 and earlier.
- Is there a fix for CVE-2026-64666?
- Yes: fixed in 0.9.3. Until then: Ensure all process-based remote session detection signals remain operational (service scanning for xrdp, process ancestry checks, loginctl and utmp monitoring), as these provide defense-in-depth protection independent of the environment variable check. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-64666 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-64666?
- Check whether you run Mcdope Pam Usb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.9.3
Ensure all process-based remote session detection signals remain operational (service scanning for xrdp, process ancestry checks, loginctl and utmp monitoring), as these provide defense-in-depth protection independent of the environment variable check.
Technical details
The vulnerability is an insecure environment variable read in src/local.c:366. The code uses getenv("XRDP_SESSION") instead of the privilege-dropping secure_getenv() function in a PAM context, allowing an attacker with local user privileges to unset the variable before invoking a setuid PAM host (login, su, sudo, polkit). While other remote-detection mechanisms (process scanning, service checks) remain in place, this specific env-based check alone can be defeated.
Affected products
- mcdope pam_usb 0.9.2 and earlier
Timeline
- 2026-05-24: disclosed
- 2026-05-25: patched
- 2026-11-11: advisory