GCVE-1988-2026-0234

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-33150 CVE-2026-33179 libfuse",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhinav Agarwal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Two memory safety vulnerabilities in libfuse's io_uring code path\n(introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the\nio_uring transport is affected; the traditional /dev/fuse path is not.\n\nAffected versions: libfuse >= 3.18.0, < 3.18.2\nFixed in: libfuse 3.18.2\n  https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2\n\n\nCVE-2026-33150: Use-After-Free\nSeverity: High (CVSS 7.8)\nCWE: CWE-416\n\nUse-after-free in io_uring session shutdown path. A local user can\ncrash the FUSE daemon or potentially execute arbitrary code.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx\nFix: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nCVE-2026-33179: NULL Pointer Dereference + Memory Leak\nSeverity: Moderate (CVSS 5.5)\nCWE: CWE-476\n\nMissing NULL checks and error-path cleanup in io_uring queue\ninitialization can crash the FUSE daemon on allocation failure\nand leak NUMA memory.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358\nFix: https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nBoth issues were reported privately to the libfuse maintainer\nand fixed in a coordinated release.\n\nTimeline:\n  2026-03-16  Use-after-free vulnerability reported to libfuse maintainer\n  2026-03-17  NULL deref vulnerability reported to libfuse maintainer\n  2026-03-18  Release 3.18.2 with fixes\n  2026-03-19  GHSA advisories published (CVE-2026-33150, CVE-2026-33179)\n\n--\nAbhinav Agarwal\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:12:06Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/12"
        },
        {
          "url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836"
        },
        {
          "url": "https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7"
        },
        {
          "url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2"
        },
        {
          "url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"
        },
        {
          "url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-33150",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33179",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0234",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12",
            "automated": true,
            "contentSha256": "4595aaa7135ad609f6410e48b1a9e8430a6c92bad3569c374111d9e5027fdcae",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-21T01:41:03Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-09T10:12:06Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0234"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}