CVE-2026-33150highCWE-416CWE-825

CVE-2026-33150: falha de alta gravidade em libfuse

Use After Free in libfuse

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar libfuse+ Monitorar fuse3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.3%
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
libfuse · libfuse
CVEs relacionadas — libfuse

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33179MEDIUMlibfuse: NULL Pointer Dereference and Memory Leak in io_uring Queue InitializationEPSS 0.2%