Read the docs
TI-2005-01763 Aliases CVE-2005-1858GHSA-4x4q-c47m-2xv4

FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages…

Priority LOW 13Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.

Why it matters now

EPSS 0.00762 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:fuse:fuse:2.2:*:*:*:*:*:*:*2.2VulnerableFuse
cpe:2.3:a:fuse:fuse:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableFuse
cpe:2.3:a:fuse:fuse:2.3_pre:*:*:*:*:*:*:*2.3_preVulnerableFuse
cpe:2.3:a:fuse:fuse:2.3_rc1:*:*:*:*:*:*:*2.3_rc1VulnerableFuse
  • cpe:2.3:a:fuse:fuse:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Fuse
  • cpe:2.3:a:fuse:fuse:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Fuse
  • cpe:2.3:a:fuse:fuse:2.3_pre:*:*:*:*:*:*:* Versions 2.3_pre Vulnerable ·Fuse
  • cpe:2.3:a:fuse:fuse:2.3_rc1:*:*:*:*:*:*:* Versions 2.3_rc1 Vulnerable ·Fuse

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-1858
  2. 2026-10-03 Alias added: GHSA-4x4q-c47m-2xv4

References

Advisory 5

  • TI-2011-00469 Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux… CVSS 2.0LOW 3.3
  • TI-2011-00468 fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a… CVSS 2.0LOW 3.3
  • TI-2011-00467 fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which… CVSS 2.0LOW 3.3
  • TI-2010-00753 fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an… CVSS 2.0LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences