Read the docs
TI-2026-25580 Aliases CVE-2026-33150

Use After Free in libfuse

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix Partial libfuse (libfuse): 3.18.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libfuselibfuse3.18.0 to before 3.18.23.18.2Patch availableCNA
  • libfuse Vendorlibfuse Affected 3.18.0 to before 3.18.2 Fixed in 3.18.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libfuse_project:libfuse:*:*:*:*:*:*:*:*3.18.0 to before 3.18.2VulnerableLibfuse Project
  • cpe:2.3:a:libfuse_project:libfuse:*:*:*:*:*:*:*:* Versions 3.18.0 to before 3.18.2 Vulnerable ·Libfuse Project

Remediation

  • Fix · CNA libfuse (libfuse) Fixed in 3.18.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33150

References

Patch 1

Advisory 1

Other 1

  • TI-2026-34775 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write CVSS 3.1CRITICAL 9.3
  • TI-2026-35992 SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences