CVE-2026-33150

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33150", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T21:17:08.885Z", "datePublished": "2026-03-20T20:20:29.963Z", "dateUpdated": "2026-07-15T01:07:15.081Z"}, "containers": {"cna": {"title": "Use After Free in libfuse", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"}, {"name": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836", "tags": ["x_refsource_MISC"], "url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836"}, {"name": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2"}], "affected": [{"vendor": "libfuse", "product": "libfuse", "versions": [{"version": ">= 3.18.0, < 3.18.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T20:20:29.963Z"}, "descriptions": [{"lang": "en", "value": "libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2."}], "source": {"advisory": "GHSA-qxv7-xrc2-qmfx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-33150"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T03:55:40.426Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "fuse", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "fuse-sshfs", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}], "datePublic": "2026-03-20T20:20:29.963Z", "descriptions": [{"lang": "en", "value": "A flaw was found in libfuse. A use-after-free vulnerability in the io_uring subsystem allows a local attacker to potentially execute arbitrary code and crash FUSE (Filesystem in Userspace) filesystem processes. This occurs when io_uring thread creation fails due to resource exhaustion, such as limits imposed by cgroup pids.max, causing a dangling pointer to be stored and later used during session shutdown. This vulnerability is reliably triggered in containerized environments."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-825", "description": "Expired Pointer Dereference", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-33150"}, {"name": "RHBZ#2449771", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449771"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33150.json"}], "timeline": [{"lang": "en", "time": "2026-03-20T21:01:20.625Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-20T20:20:29.963Z", "value": "Made public."}], "title": "libfuse: libfuse: Arbitrary code execution via use-after-free in io_uring subsystem", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:07:15.081Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "libfuse: libfuse: Arbitrary code execution via use-after-free in io_uring subsystem", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "fuse", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "fuse-sshfs", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-03-20T21:01:20.625Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-20T20:20:29.963Z", "value": "Made public."}], "x_adpType": "supplier", "datePublic": "2026-03-20T20:20:29.963Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-33150", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449771", "name": "RHBZ#2449771", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33150.json", "tags": ["x_sadp-csaf-vex"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in libfuse. A use-after-free vulnerability in the io_uring subsystem allows a local attacker to potentially execute arbitrary code and crash FUSE (Filesystem in Userspace) filesystem processes. This occurs when io_uring thread creation fails due to resource exhaustion, such as limits imposed by cgroup pids.max, causing a dangling pointer to be stored and later used during session shutdown. This vulnerability is reliably triggered in containerized environments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-825", "description": "Expired Pointer Dereference"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:07:15.081Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33150", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T18:49:49.509333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:52:37.326Z"}}], "cna": {"title": "Use After Free in libfuse", "source": {"advisory": "GHSA-qxv7-xrc2-qmfx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "libfuse", "product": "libfuse", "versions": [{"status": "affected", "version": ">= 3.18.0, < 3.18.2"}]}], "references": [{"url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx", "name": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836", "name": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2", "name": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T20:20:29.963Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33150", "state": "PUBLISHED", "dateUpdated": "2026-07-15T01:07:15.081Z", "dateReserved": "2026-03-17T21:17:08.885Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T20:20:29.963Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libfuse", "vendor": "libfuse", "versions": [{"status": "affected", "version": ">= 3.18.0, < 3.18.2"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "fuse", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "fuse-sshfs", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libfuse_project:libfuse:*:*:*:*:*:*:*:*", "matchCriteriaId": "83EF6E3E-F5F2-4CE2-B497-62493DAB2A1F", "versionEndExcluding": "3.18.2", "versionStartIncluding": "3.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2."}, {"lang": "es", "value": "libfuse es la implementaci\u00f3n de referencia de FUSE de Linux. Desde la versi\u00f3n 3.18.0 hasta antes de la versi\u00f3n 3.18.2, una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en el subsistema io_uring de libfuse permite a un atacante local colapsar procesos del sistema de archivos FUSE y potencialmente ejecutar c\u00f3digo arbitrario. Cuando la creaci\u00f3n de hilos de io_uring falla debido al agotamiento de recursos (por ejemplo, cgroup pids.max), fuse_uring_start() libera la estructura del pool de anillos pero almacena el puntero colgante en el estado de la sesi\u00f3n, lo que lleva a un uso despu\u00e9s de liberaci\u00f3n cuando la sesi\u00f3n se cierra. El disparador es fiable en entornos contenerizados donde los l\u00edmites de cgroup pids.max restringen naturalmente la creaci\u00f3n de hilos. Este problema ha sido parcheado en la versi\u00f3n 3.18.2."}], "id": "CVE-2026-33150", "lastModified": "2026-07-15T02:20:03.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33150", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-20T21:17:15.410", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-33150"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449771"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33150.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-825"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "libfuse: libfuse: Arbitrary code execution via use-after-free in io_uring subsystem", "id": "2449771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449771"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in libfuse. A use-after-free vulnerability in the io_uring subsystem allows a local attacker to potentially execute arbitrary code and crash FUSE (Filesystem in Userspace) filesystem processes. This occurs when io_uring thread creation fails due to resource exhaustion, such as limits imposed by cgroup pids.max, causing a dangling pointer to be stored and later used during session shutdown. This vulnerability is reliably triggered in containerized environments."], "name": "CVE-2026-33150", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "fuse", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "fuse-sshfs", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2026-03-20T20:20:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33150\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33150\nhttps://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836\nhttps://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2\nhttps://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "libfuse", "source": "cna", "vendor": "libfuse"}, "product": "libfuse", "vendor": "libfuse"}], "analysis": {"en": {"generated_at": "2026-03-26T15:00:56.850379+00:00", "value": {"mitigation_remediation": ["Upgrade libfuse to version 3.18.2 or newer."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects libfuse versions from 3.18.0 up to, but not including, 3.18.2. All Linux systems running the default FUSE reference implementation and using io_uring for file system operations are impacted. The patch is available in libfuse 3.18.2 and later.", "description_and_impact": "A use\u2011after\u2011free flaw exists in libfuse\u2019s io_uring subsystem. When thread creation fails, the ring pool structure is freed while a dangling pointer remains in session state. During cleanup this pointer is dereferenced, allowing a local attacker to crash the filesystem process or, if they control memory, execute arbitrary code. The issue maps to CWE\u2011416 (Use After Free) and CWE\u2011825 (Use of Uninitialized Variable).", "risk_and_exploitability": "The CVSS base score is 7.8, indicating high severity. EPSS is below 1% and the vulnerability is not listed in the CISA KEV catalog, marking it as low probability of exploitation. The attack vector is local; exploitation requires an attacker with access to the host or a container running the vulnerable FUSE instance, especially in environments where cgroup pids.max limits thread creation. Successful exploitation can result in application crashes or arbitrary code execution with the privileges of the FUSE process."}}}}, "created": "2026-03-23T09:52:43.880625+00:00", "updated": "2026-03-27T09:21:29.863072+00:00", "vendors": ["libfuse", "libfuse$PRODUCT$libfuse"]}