Lima CVE-2026-53657

Requires a Lima instance running specifically with the QEMU driver AND the guest agent enabled, plus the attacker already having any unprivileged local user account/shell inside the guest VM (AV:L). Exploitation limits: it is not remotely reachable and not usable without prior in-guest access, so it is only relevant where an untrusted party can obtain a foothold in the VM (multi-user VMs, container-to-VM escape, or shared/CI guests); instances using other drivers or with the guest agent disabled are not affected. No user interaction is needed once in-guest access exists.

Signals are moderately consistent but not urgent. CVSS 3.1 is 8.2 (AV:L/AC:L/PR:H/UI:N/S:C, full CIA impact) - local vector, low complexity, scope change to root. Note a discrepancy: the vendor vector encodes PR:H, yet the description says 'an arbitrary user in the VM' can access the socket, which implies only low privilege (PR:L) is truly required - this makes real-world exploitability somewhat higher than PR:H suggests, and I independently score it PR:L (see assessed vector). There is no EPSS score, no KEV listing, and no published POC in the provided data, so this is a high-severity local escalation rather than a mass-exploited internet-facing bug. Practical risk concentrates in multi-user guest VMs or scenarios where an attacker already has any unprivileged foothold in the Lima guest; single-user developer laptops face lower marginal risk since the attacker would already control the workload.

An attacker with any unprivileged shell in a Lima QEMU guest (e.g., a compromised container escape to the VM user, or a shared multi-user VM) opens /run/lima-guestagent.sock and requests a tunnel to a privileged Unix socket such as the system D-Bus. Through that root-owned daemon they invoke privileged methods to run commands as root inside the VM, completing local privilege escalation. No public POC is currently identified, but the technique follows directly from the documented tunneling behavior.