CVE-2026-52791

Received Received - Intake

fuse-overlayfs SUID/SGID Privilege Escalation via Mode Bit Preservation

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-52791

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

fuse-overlayfs is a FUSE-based implementation of overlayfs for rootless containers. The vulnerability exists in versions before 1.17 where the release-1.x C branch incorrectly preserves SUID and SGID mode bits during file truncation operations. This allows a low-privileged user to set a file's mode to 4777, granting it execute permissions for all users.

Detection Guidance

To detect this vulnerability, check the version of fuse-overlayfs installed on your system. Run: fuse-overlayfs --version. If the version is below 1.17, the system is vulnerable.

Impact Analysis

An attacker with low privileges could exploit this to create files with elevated permissions (SUID/SGID bits set), potentially allowing privilege escalation. This could lead to unauthorized system access or execution of malicious code with higher privileges than intended.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and privilege management, such as HIPAA's access control standards or GDPR's integrity and confidentiality principles. Unauthorized privilege escalation risks data breaches and unauthorized access.

Mitigation Strategies

Upgrade fuse-overlayfs to version 1.17 or later immediately. Use your package manager to update: sudo apt-get update && sudo apt-get install fuse-overlayfs or equivalent for your distribution.

Hi! I’m here to help you understand CVE-2026-52791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70