Vulnerabilityhigh
Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-44731 | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap | 7.8 | <1% | PoC ×4 | |
| CVE-2022-3328 | Race condition in snap-confine's must_mkdir_and_open_with_perms() | 7.0 | <1% | ||
| CVE-2026-3888 | Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is… | 7.8 | 1% | PoC ×2 | |
| CVE-2026-8933 | A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure… | 7.8 | <1% |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7. 8), impacts default installations of Ubuntu Desktop 24.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.