Threats affecting pkg:github/PackageKit

CVE-2026-104620 is a high-severity vulnerability in PackageKit before version 1.4.1. It involves a relative path traversal flaw in the Zypp backend's simulation of actions, which local attackers could exploit to gain root privileges.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.