GCVE-1988-2026-0234
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:12
VLAI
EPSS
VEX
Title
CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref)
Summary
Two memory safety vulnerabilities in libfuse's io_uring code path
(introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the
io_uring transport is affected; the traditional /dev/fuse path is not.
Affected versions: libfuse >= 3.18.0, < 3.18.2
Fixed in: libfuse 3.18.2
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2
CVE-2026-33150: Use-After-Free
Severity: High (CVSS 7.8)
CWE: CWE-416
Use-after-free in io_uring session shutdown path. A local user can
crash the FUSE daemon or potentially execute arbitrary code.
Advisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx
Fix: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836
Credit: Abhinav Agarwal (reporter)
Remediation review: Akshat Sinha
CVE-2026-33179: NULL Pointer Dereference + Memory Leak
Severity: Moderate (CVSS 5.5)
CWE: CWE-476
Missing NULL checks and error-path cleanup in io_uring queue
initialization can crash the FUSE daemon on allocation failure
and leak NUMA memory.
Advisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358
Fix: https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7
Credit: Abhinav Agarwal (reporter)
Remediation review: Akshat Sinha
Both issues were reported privately to the libfuse maintainer
and fixed in a coordinated release.
Timeline:
2026-03-16 Use-after-free vulnerability reported to libfuse maintainer
2026-03-17 NULL deref vulnerability reported to libfuse maintainer
2026-03-18 Release 3.18.2 with fixes
2026-03-19 GHSA advisories published (CVE-2026-33150, CVE-2026-33179)
--
Abhinav Agarwal
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Cve | CVE-2026-33150 CVE-2026-33179 libfuse |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0234 (this record)
- related CVE-2026-33150
- related CVE-2026-33179
{
"containers": {
"cna": {
"affected": [
{
"product": "CVE-2026-33150 CVE-2026-33179 libfuse",
"vendor": "Cve",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal"
}
],
"descriptions": [
{
"lang": "en",
"value": "Two memory safety vulnerabilities in libfuse\u0027s io_uring code path\n(introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the\nio_uring transport is affected; the traditional /dev/fuse path is not.\n\nAffected versions: libfuse \u003e= 3.18.0, \u003c 3.18.2\nFixed in: libfuse 3.18.2\n https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2\n\n\nCVE-2026-33150: Use-After-Free\nSeverity: High (CVSS 7.8)\nCWE: CWE-416\n\nUse-after-free in io_uring session shutdown path. A local user can\ncrash the FUSE daemon or potentially execute arbitrary code.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx\nFix: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nCVE-2026-33179: NULL Pointer Dereference + Memory Leak\nSeverity: Moderate (CVSS 5.5)\nCWE: CWE-476\n\nMissing NULL checks and error-path cleanup in io_uring queue\ninitialization can crash the FUSE daemon on allocation failure\nand leak NUMA memory.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358\nFix: https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nBoth issues were reported privately to the libfuse maintainer\nand fixed in a coordinated release.\n\nTimeline:\n 2026-03-16 Use-after-free vulnerability reported to libfuse maintainer\n 2026-03-17 NULL deref vulnerability reported to libfuse maintainer\n 2026-03-18 Release 3.18.2 with fixes\n 2026-03-19 GHSA advisories published (CVE-2026-33150, CVE-2026-33179)\n\n--\nAbhinav Agarwal\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:12:06Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/12"
},
{
"url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836"
},
{
"url": "https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7"
},
{
"url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2"
},
{
"url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"
},
{
"url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/12"
],
"discovery": "EXTERNAL"
},
"title": "CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-33150",
"type": "related"
},
{
"destId": "CVE-2026-33179",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0234",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12",
"automated": true,
"contentSha256": "4595aaa7135ad609f6410e48b1a9e8430a6c92bad3569c374111d9e5027fdcae",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/12",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-21T01:41:03Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0234"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:41Z",
"dateUpdated": "2026-09-09T10:12:06Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0234"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…