← Vulnerability feed

Vulnerability record · CVE-2026-33150 · published 20 March 2026

CVE-2026-33150: Libfuse project libfuse use after free vulnerability

LLibfuse Project · Libfuse

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.

7.8 CVSS 3.1 High EPSS 0.19% · top 92.2% CWE-416 · Use after freeCWE-825 · CWE-825
7.8CVSS 3.1 base score
0.19%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
15 Jul 2026Last modified by NVD

Description

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836 Patch
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 ProductRelease Notes
https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33150
https://bugzilla.redhat.com/show_bug.cgi?id=2449771
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33150.json

Track CVE-2026-33150 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.8CVE-2010-3879Libfuse project libfuse link following vulnerabilityFUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a …EPSS 9.8%5.5CVE-2026-33179Libfuse project libfuse null pointer dereference vulnerabilitylibfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak i…EPSS 0.17%7.0CVE-2026-68820Windows Ancillary Function Driver for WinSock use-after-free privilege escalationThe Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free (CWE-416) that lets an authorized local attacker elevate privil…KEVEPSS 0.33%analysed8.8CVE-2010-0806Microsoft Internet Explorer Peer Objects use-after-free allows remote code executionInternet Explorer 6, 6 SP1 and 7 contain a use-after-free in the Peer Objects component (iepeers.dll), where an object is accessed after deletion, le…KEVEPSS 82%analysed8.8CVE-2010-0249Microsoft Internet Explorer use-after-free enables remote code executionInternet Explorer 6, 7 and 8 mishandle objects in memory, leaving a dangling pointer that can be reused after the object is freed. A remote attacker …KEVEPSS 92%analysed7.8CVE-2020-9715Adobe Acrobat and Reader use-after-free allows code executionAdobe Acrobat and Reader contain a use-after-free (CWE-416) flaw affecting versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and ea…KEVEPSS 49%analysed8.8CVE-2026-5281Google Chrome Dawn use-after-free allows remote code executionChrome versions before 146.0.7680.178 contain a use-after-free flaw in the Dawn graphics component. An attacker who has already compromised the rende…KEVEPSS 0.70%analysed8.8CVE-2023-43000Apple WebKit use-after-free via malicious web contentA use-after-free flaw in Apple's WebKit engine was fixed by improved memory management in macOS Ventura 13.5, iOS/iPadOS 16.6, Safari 16.6, and iOS/i…KEVEPSS 3.9%analysed

Source: NIST National Vulnerability Database (record CVE-2026-33150), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.