# CVE-2026-84410: apport improper privilege management via ldd DT_AUDIT code execution

Source: https://junglewise.ai/threats/cve-2026-84410-in-apport-before-2-37-0-an-improper-privilege-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-84410 · Severity: info · Published 2026-11-09

Apport is Ubuntu's automatic crash reporting system that runs as root to collect and process system crash dumps. A local attacker can place a malicious crash file in the world-writable /var/crash directory, causing the root-level crash processing pipeline to execute arbitrary code with root privileges through a dynamic loader audit module. This provides complete system compromise without requiring authentication or memory corruption exploits.

Technologies: [Canonical Apport](https://junglewise.ai/threats/technologies/apport). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-84410 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84410 being exploited in the wild.

**How severe is CVE-2026-84410?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Canonical Apport before 2.37.0.

**Is there a fix for CVE-2026-84410?** Yes: fixed in apport 2.37.0. Until then: Disable automatic crash reporting by masking the apport-autoreport.service and apport-autoreport.timer systemd units, or restrict write access to the /var/crash directory until the system can be updated. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84410 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-84410?** Check whether you run Canonical Apport at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in apport 2.37.0

Disable automatic crash reporting by masking the apport-autoreport.service and apport-autoreport.timer systemd units, or restrict write access to the /var/crash directory until the system can be updated.

## Technical details

The vulnerability is improper privilege management (CWE-269) combined with unsafe execution of untrusted binaries (CWE-78-adjacent). Apport's root-level automatic crash processing invokes ldd on an attacker-controlled ExecutablePath field from crash files, allowing exploitation of the ELF DT_AUDIT dynamic loader tag to load and execute arbitrary audit modules as root. The vulnerability requires only that the attacker place a crafted file in /var/crash and have local system access; automatic crash reporting must be enabled on the target.

## Affected products

- Canonical apport before 2.37.0

## Timeline

- 2026-08-21: disclosed
- 2026-11-09: advisory
- 2026-11-09: patched: apport 2.37.0 replaces ldd call with readelf to safely analyze binary dependencies

## References

- [https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2164767](https://bugs.launchpad.net/ubuntu/+source/apport/+bug/2164767)
- [https://github.com/canonical/apport/commit/bc7cc6a70590d6596e1f96ad74a021f2c598d73d](https://github.com/canonical/apport/commit/bc7cc6a70590d6596e1f96ad74a021f2c598d73d)

## Related threats

- [apport path traversal in extract_keys via base64-encoded keys](https://junglewise.ai/threats/cve-2026-86692-in-apport-before-2-37-0-a-path-traversal-vulnerability-allows-an)
- [Canonical Apport path traversal in apport-unpack](https://junglewise.ai/threats/cve-2026-77113-canonical-apport-path-traversal-in-apport-unpack)
- [It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash…](https://junglewise.ai/threats/cve-2025-5467-it-was-discovered-that-process-crash-in-data-apport-in-canonical-s)