Google fuse-archive EUVD-2026-88074

Requires local access as a user who can either prepend a directory to the PATH used by the fuse-archive process or write a malicious binary into an existing writable, attacker-controlled directory that already appears in that PATH. Exploitation further requires that fuse-archive be run WITHOUT the '-o noexternal' option so external decompression filters are invoked, and that a victim actually mount an archive whose format triggers an external helper (e.g. base64/gpg). Limiting factors: local-only vector, required victim interaction (mounting), the non-default precondition of a writable PATH entry earlier than the legitimate binaries, and that versions 1.22-1.23 are partially mitigated with full remediation only in 1.24.

This is a local privilege-context code-execution flaw (CWE-426, untrusted search path) in Google fuse-archive, not a remotely exploitable network vulnerability. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:A) scores 5.4 (medium) and is internally consistent: local attack vector, an attack requirement (AT:P - a writable/attacker-controllable PATH entry must exist), low privileges, and required user/victim interaction (a victim must actually mount an archive that triggers an external decompression filter such as base64 or gpg). No EPSS score, no CISA KEV listing, and no standalone public exploit were provided - there is no public exploit identified at time of analysis (the PATH-sanitization test added in the fix commit demonstrates the issue but is a regression test, not weaponized exploit code). The high VC/VI/VA:H impact reflects full arbitrary code execution in the target user's context, which legitimately drives severity up, but the local vector plus required user interaction and the non-default precondition of a writable PATH directory keep real-world risk moderate and opportunistic rather than mass-exploitable. Net: a genuine but conditional local code-execution issue - real for multi-user or shared-host scenarios, low urgency for typical single-user desktop installs. The 'RCE' tag is technically local code execution triggered by local search-path hijacking, not network RCE; treat it as such when prioritizing.

On a multi-user or shared host, a low-privileged attacker plants a malicious executable named after an external decompression helper (e.g. 'base64' or 'gpg') in a directory that is writable and appears earlier in PATH, or influences the PATH of a higher-privileged victim. When that victim mounts an archive with fuse-archive that invokes the external filter, the attacker's binary runs with the victim's privileges. No public exploit is identified, though the fix commit's test.py illustrates the execution pathway.