Read the docs
TI-2026-23252 Aliases CVE-2026-29111

systemd: Local unprivileged user can trigger an assert

Priority LOW 24CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 36 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix Partial systemd (systemd): 257.11, 258.5, 259.2Red Hat: 45 advisoriesRed Hat: 36 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
systemdsystemd239 to before 257.11; 258 to before 258.5; 259 to before 259.2257.11, 258.5, 259.2Patch availableCNA
  • systemd Vendorsystemd Affected 239 to before 257.11; 258 to before 258.5; 259 to before 259.2 Fixed in 257.11, 258.5, 259.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*239 to before 257.11; 258 to before 258.5; 259 to before 259.2Vulnerablesystemd
  • cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* Versions 239 to before 257.11; 258 to before 258.5; 259 to before 259.2 Vulnerable ·systemd

Remediation

  • Fix · CNA systemd (systemd) Fixed in 257.11, 258.5, 259.2

Red Hat 45 advisories

  • RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 42 more Red Hat advisories
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
  • RHSA-2026:67857 Released 2026-09-28 · Red Hat rating Important
    OpenShift Container Platform 4.15.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202609140326-0, rhcos-ppc64le-415.92.202609140326-0, rhcos-s390x-415.92.202609140326-0 +1
  • RHSA-2026:65839 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.71 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202609080414-0
  • RHSA-2026:65851 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.18.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202609031320-0, rhcos-ppc64le-418.94.202609031320-0, rhcos-s390x-418.94.202609031320-0 +1
  • RHSA-2026:62409 Released 2026-09-14 · Red Hat rating Important
    OpenShift Container Platform 4.14.73 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202609011250-0, rhcos-ppc64le-414.92.202609011250-0, rhcos-s390x-414.92.202609011250-0 +1
  • RHSA-2026:62549 Released 2026-09-10 · Red Hat rating Important
    OpenShift Container Platform 4.16.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202609011112-0, rhcos-ppc64le-416.94.202609011112-0, rhcos-s390x-416.94.202609011112-0 +1
  • RHSA-2026:59831 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.12.97 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202608241157-0
  • RHSA-2026:60019 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202608250221-0, rhcos-ppc64le-417.94.202608250221-0, rhcos-s390x-417.94.202608250221-0 +1
  • RHSA-2026:57402 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.19.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202608182320-0, rhcos-ppc64le-4.19.9.6.202608182320-0, rhcos-s390x-4.19.9.6.202608182320-0 +1
  • RHSA-2026:57483 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.18.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202608142238-0, rhcos-ppc64le-418.94.202608142238-0, rhcos-s390x-418.94.202608142238-0 +1
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:51277 Released 2026-08-06 · Red Hat rating Moderate
    systemd security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) systemd-devel-252-14.el9_2.11, systemd-journal-remote-252-14.el9_2.11
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) rhel-net-naming-sysattrs-252-14.el9_2.11, systemd-252-14.el9_2.11, systemd-container-252-14.el9_2.11 +6
  • RHSA-2026:51134 Released 2026-08-06 · Red Hat rating Moderate
    systemd security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) systemd-devel-252-32.el9_4.11, systemd-journal-remote-252-32.el9_4.11
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) rhel-net-naming-sysattrs-252-32.el9_4.11, systemd-252-32.el9_4.11, systemd-container-252-32.el9_4.11 +6
  • RHSA-2026:50077 Released 2026-08-04 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) systemd-239-58.el8_6.16, systemd-container-239-58.el8_6.16, systemd-devel-239-58.el8_6.16 +5
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) systemd-239-58.el8_6.16, systemd-container-239-58.el8_6.16, systemd-devel-239-58.el8_6.16 +5
  • RHSA-2026:50050 Released 2026-08-04 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) systemd-239-74.el8_8.7, systemd-container-239-74.el8_8.7, systemd-devel-239-74.el8_8.7 +5
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) systemd-239-74.el8_8.7, systemd-container-239-74.el8_8.7, systemd-devel-239-74.el8_8.7 +5
  • RHSA-2026:50051 Released 2026-08-04 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) systemd-239-45.el8_4.17, systemd-container-239-45.el8_4.17, systemd-devel-239-45.el8_4.17 +5
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) systemd-239-45.el8_4.17, systemd-container-239-45.el8_4.17, systemd-devel-239-45.el8_4.17 +5
  • RHSA-2026:49910 Released 2026-08-04 · Red Hat rating Moderate
    systemd security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) systemd-boot-unsigned-252-51.el9_6.6, systemd-devel-252-51.el9_6.6, systemd-journal-remote-252-51.el9_6.6 +1
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) rhel-net-naming-sysattrs-252-51.el9_6.6, systemd-252-51.el9_6.6, systemd-container-252-51.el9_6.6 +6
  • RHSA-2026:25900 Released 2026-06-15 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) systemd-boot-unsigned-257-9.el10_0.2, systemd-devel-257-9.el10_0.2, systemd-journal-remote-257-9.el10_0.2 +1
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) systemd-257-9.el10_0.2, systemd-container-257-9.el10_0.2, systemd-libs-257-9.el10_0.2 +5
  • RHSA-2026:22634 Released 2026-06-02 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2026:21275 Released 2026-05-27 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.1 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:19213 Released 2026-05-19 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux AppStream (v. 9) systemd-boot-unsigned-252-67.el9_8.2, systemd-devel-252-67.el9_8.2, systemd-journal-remote-252-67.el9_8.2 +1
    • Red Hat Enterprise Linux BaseOS (v. 9) rhel-net-naming-sysattrs-252-67.el9_8.2, systemd-252-67.el9_8.2, systemd-container-252-67.el9_8.2 +6
  • RHSA-2026:19068 Released 2026-05-19 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux AppStream (v. 10) systemd-boot-unsigned-257-23.el10_2.1, systemd-devel-257-23.el10_2.1, systemd-journal-remote-257-23.el10_2.1 +1
    • Red Hat Enterprise Linux BaseOS (v. 10) systemd-257-23.el10_2.1, systemd-container-257-23.el10_2.1, systemd-libs-257-23.el10_2.1 +5
  • RHSA-2026:14162 Released 2026-05-06 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.9.3 release
    • Red Hat OpenShift distributed tracing 3.9.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9
  • RHSA-2026:13677 Released 2026-05-05 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux AppStream (v. 9) systemd-boot-unsigned-252-55.el9_7.9, systemd-devel-252-55.el9_7.9, systemd-journal-remote-252-55.el9_7.9 +1
    • Red Hat Enterprise Linux BaseOS (v. 9) rhel-net-naming-sysattrs-252-55.el9_7.9, systemd-252-55.el9_7.9, systemd-container-252-55.el9_7.9 +6
  • RHSA-2026:13651 Released 2026-05-05 · Red Hat rating Moderate
    systemd security update
    • Red Hat Enterprise Linux AppStream (v. 10) systemd-boot-unsigned-257-13.el10_1.3, systemd-devel-257-13.el10_1.3, systemd-journal-remote-257-13.el10_1.3 +1
    • Red Hat Enterprise Linux BaseOS (v. 10) systemd-257-13.el10_1.3, systemd-container-257-13.el10_1.3, systemd-libs-257-13.el10_1.3 +5
  • RHSA-2026:7299 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images systemd-260.1-2.1.hum1@aarch64, systemd-260.1-2.1.hum1@src, systemd-260.1-2.1.hum1@x86_64 +40

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72502
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:13651, RHSA-2026:19068
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:13677, RHSA-2026:19213
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:51277
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:51134
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:25900
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:49910
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:13651, RHSA-2026:19068
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:13677, RHSA-2026:19213
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:50051
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:50077
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:50050
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:51277
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:51134
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:25900
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:49910
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:50051
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:50077
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:50050
Red Hat Hardened ImagesFixed RHSA-2026:7299
Red Hat Insights proxy 1.5Fixed RHSA-2026:22634
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:59831
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:65839
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:62409
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:67857
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:62549
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:60019
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:57483, RHSA-2026:65851
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:57402
Red Hat OpenShift distributed tracing 3.9.3Fixed RHSA-2026:14162
Red Hat Update Infrastructure 5Fixed RHSA-2026:21275, RHSA-2026:58981
Not affected: 5 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift distributed tracing 3.9.3
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29111
  2. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  3. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  4. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  7. 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
  8. 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
  9. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat

References

Patch 11

  • TI-2023-11736 systemd before 247 does not adequately block local privilege escalation for some Sudo… CVSS 3.1HIGH 7.8
  • TI-2017-06857 In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can… CVSS 3.1HIGH 7.5
  • TI-2026-29031 In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. CVSS 3.1MEDIUM 6.4
  • TI-2022-04038 Information disclosure in systemd CVSS 3.1MEDIUM 5.5
  • TI-2025-04111 Systemd-coredump: race condition that allows a local attacker to crash a suid program and… CVSS 3.1MEDIUM 4.7
  • TI-2017-11647 In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS… CVSS 3.1HIGH 7.5
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences