CVE-2016-1580

The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1...

9.8 CriticalFix available

The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with "ubuntu-core."

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.48%Up 2.4 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-1580
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-1580
Updated: 2026-11-02

EUVDEUVD-2016-2675 No score

Record: EUVD-2016-2675
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qh3c-5ph2-fh82 9.8

The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1...

Record: GHSA-qh3c-5ph2-fh82
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-1580 9.8

Record: UBUNTU-CVE-2016-1580
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-2956-1 No score

ubuntu-core-launcher vulnerability

Zygmunt Krynicki discovered that ubuntu-core-launcher did not properly sanitize its input and contained a logic error when determining the mountpoint of bind mounts when using snaps on Ubuntu classic systems (eg, traditional desktop and server). If a user were tricked into installing a malicious snap with a crafted snap name, an attacker could perform a delayed attack to steal data or execute code within the security context of another snap. This issue did not affect Ubuntu Core systems.

Record: USN-2956-1
Updated: 2026-11-02

Affected products

canonical ubuntu-core-launcher

Affected packages

Affected packages
Package	Affected	Fixed
`ubuntu-core-launcher` Ubuntu:16.04:LTS	before 1.0.27.1, plus listed versions 1.0.91.0.101.0.131.0.141.0.17 Show 8 moreShow less 1.0.181.0.191.0.201.0.221.0.231.0.251.0.25.11.0.27	1.0.27.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1580 is a critical vulnerability (CVSS 9.8) in Canonical Ubuntu-core-launcher, published April 29, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.48%, the 89th percentile. Fixed in ubuntu-core-launcher 1.0.27.1.