Every CVE Search/ Get API key

CVE-2026-52791

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

2.0 LowFix available

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.14%Up 0.1 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.0

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
CVE-2026-52791
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-266
Updated
2026-11-02
EUVDEUVD-2026-50403 2.0

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
EUVD-2026-50403
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 2.0

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
CVE-2026-52791
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-266
Updated
2026-11-02
OSV 2.0

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
CVE-2026-52791
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-266
Updated
2026-11-02
OSVDEBIAN-CVE-2026-52791 2.0

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
DEBIAN-CVE-2026-52791
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:52805 4.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:52805
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2026-52791 2.0

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
UBUNTU-CVE-2026-52791
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-94145 No score

CVE-2026-52791 affecting package fuse-overlayfs 1.14-1

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

Record
AZL-94145
Updated
2026-11-05
OSVMGASA-2026-0462 No score

Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478)

Record
MGASA-2026-0462
Updated
2026-11-02
OSVopenSUSE-SU-2026:11461-1 No score

fuse-overlayfs-1.17-1.1 on GA media

These are all security issues fixed in the fuse-overlayfs-1.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11461-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21753-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

  • CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation (bsc#1273100).
Record
openSUSE-SU-2026:21753-1
Updated
2026-11-02
OSVSUSE-SU-2026:23252-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

  • CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation (bsc#1273100).
Record
SUSE-SU-2026:23252-1
Updated
2026-11-02
OSVSUSE-SU-2026:23469-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

  • CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation (bsc#1273100).
Record
SUSE-SU-2026:23469-1
Updated
2026-11-02
OSVSUSE-SU-2026:23618-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

  • CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate operation (bsc#1273100).
Record
SUSE-SU-2026:23618-1
Updated
2026-11-02
OSVSUSE-SU-2026:4026-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

  • CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation (bsc#1273100).
Record
SUSE-SU-2026:4026-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fuse-overlayfs
Azure Linux:3
 through 1.14-1 None known
fuse-overlayfs
Debian:12
 All versions, plus listed versions
1.10-11.13-11.14-1
 None known
fuse-overlayfs
Debian:13
 All versions, plus listed versions
1.14-1
 None known
fuse-overlayfs
Debian:14
 All versions, plus listed versions
1.14-1
 None known
fuse-overlayfs
Mageia:10
From an advisory covering 2 CVEs
 before 1.18-1.mga10
1.18-1.mga10
fuse-overlayfs
Red Hat:hummingbird:1
 before 0:1.17-1.hum1
0:1.17-1.hum1
fuse-overlayfs
SUSE:Linux Micro 6.0
 before 1.12-2.1
1.12-2.1
fuse-overlayfs
SUSE:Linux Micro 6.2
 before 1.15-160000.3.1
1.15-160000.3.1
fuse-overlayfs
SUSE:Linux Enterprise Server 16.0
 before 1.15-160000.3.1
1.15-160000.3.1
fuse-overlayfs
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.15-160000.3.1
1.15-160000.3.1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
fuse-overlayfs
SUSE:Linux Enterprise Micro 5.3
 before 1.1.2-150100.3.14.1
1.1.2-150100.3.14.1
fuse-overlayfs
SUSE:Linux Enterprise Micro 5.4
 before 1.1.2-150100.3.14.1
1.1.2-150100.3.14.1
fuse-overlayfs
SUSE:Linux Enterprise Micro 5.5
 before 1.1.2-150100.3.14.1
1.1.2-150100.3.14.1
fuse-overlayfs
SUSE:Linux Enterprise Module for Containers 15 SP7
 before 1.1.2-150100.3.14.1
1.1.2-150100.3.14.1
fuse-overlayfs
SUSE:Enterprise Storage 7.1
 before 1.1.2-150100.3.14.1
1.1.2-150100.3.14.1
fuse-overlayfs
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.3-10.7-10.7.2-10.7.3-10.7.4-10.7.5-10.7.6-1
 None known
fuse-overlayfs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.0-11.7.1-1
 None known
fuse-overlayfs
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.10-11.13-1
 None known
fuse-overlayfs
Ubuntu:26.10
 All versions, plus listed versions
1.14-1build2
 None known
fuse-overlayfs
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.14-1build11.14-1build2
 None known
fuse-overlayfs
openSUSE:Tumbleweed
 before 1.17-1.1
1.17-1.1
fuse-overlayfs
openSUSE:Leap 16.0
 before 1.15-160000.3.1
1.15-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-52791 is a low vulnerability (CVSS 2.0) in Containers Fuse-overlayfs, published July 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in fuse-overlayfs 0:1.17-1.hum1.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open