Skip to main content

Libfuse CVE-2026-33150

| EUVDEUVD-2026-13786 HIGH
Use After Free (CWE-416)
2026-03-20 GitHub_M
RCE Denial Of Service Use After Free Memory Corruption Libfuse
7.8
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Apr 16, 2026 - 06:19 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
3.18.2
PoC Detected
Mar 23, 2026 - 19:16 vuln.today
Public exploit code
EUVD ID Assigned
Mar 20, 2026 - 20:46 euvd
EUVD-2026-13786
Analysis Generated
Mar 20, 2026 - 20:46 vuln.today
CVE Published
Mar 20, 2026 - 20:20 nvd
HIGH 7.8

DescriptionCVE.org

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.

AnalysisAI

libfuse versions 3.18.0 through 3.18.1 contain a use-after-free vulnerability in the io_uring subsystem that allows local attackers to crash FUSE filesystem processes or execute arbitrary code when thread creation fails under resource constraints. The flaw occurs when io_uring initialization fails (e.g., due to cgroup limits), leaving a dangling pointer in session state that is dereferenced during shutdown. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

libfuse (Filesystem in Userspace) is the reference implementation for FUSE on Linux, enabling userspace filesystem implementations. The affected component is cpe:2.3:a:libfuse:libfuse versions 3.18.0 through 3.18.1. The vulnerability is classified as CWE-416 (Use After Free), a memory corruption issue where the fuse_uring_start() function in the io_uring subsystem fails to properly handle resource exhaustion during thread creation. When pthread_create fails due to cgroup constraints like pids.max, the function frees the ring pool structure but leaves a dangling pointer stored in the session state. This pointer is later dereferenced during session shutdown, resulting in a use-after-free condition that can lead to crashes or arbitrary code execution if the freed memory is reallocated and controlled by an attacker.

RemediationAI

Upgrade libfuse to version 3.18.2 or later immediately, as documented in the release notes at https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2. The patch commit 49fcd891a58f622c098e2ca67d66086f7b213836 available at https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836 addresses the use-after-free by properly handling thread creation failures. For environments where immediate patching is not feasible, consider temporarily increasing cgroup pids.max limits to reduce the likelihood of thread creation failures, though this is not a complete mitigation. Review and restrict local user access to systems running FUSE filesystems, and monitor for unexpected FUSE process crashes that could indicate exploitation attempts.

More in Libfuse

View all
CVE-2026-33179 MEDIUM POC
5.5 Mar 20

libfuse versions 3.18.0 through 3.18.1 contain a NULL pointer dereference and memory leak vulnerability in the fuse_urin

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.2 Fixed

Share

CVE-2026-33150 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy