CVE-2026-33179

Katalog CVE

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan NULL Pointer Dereference pada libfuse project libfuse. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue entry setup, the code proceeds with NULL pointers. When fuse_uring_register_queue fails, NUMA allocations are leaked and the function incorrectly returns success. Only the io_uring transport is affected; the traditional /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been patched in version 3.18.2.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358 advisory vendor
• https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7 patch
• https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 product · release notes