When polkit is processing a XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This can lead polkit to crash or other unexpected behavior and arbitrary code execution is not discarded. To explore this flaw, a high privilege account is needed as it's required to properly place the malicious policy file.