A flaw was found in polkit. A regression in the fix for CVE-2026-4897 introduced a stack buffer underflow (out-of-bounds read) in the read_cookie() function of the polkit-agent-helper-1 setuid helper. When an empty cookie is read from standard input, the string-length computation underflows and one byte is read outside the bounds of the stack buffer.