High 7.8Published Mar 17, 2026

CVE-2026-3888Local Privilege Escalation in snapd

Updated under an hour ago (Oct 27, 2026, 5:20 PM ET)

Does this affect you?

It affects Canonical Ubuntu 16.04 LTS and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Canonical Ubuntu 16.04 LTS

Exploited in the last 30 days

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-268
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: canonical
NVD analysis: Analyzed
Record last updated: Mar 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Canonical Ubuntu 16.04 LTS canonical:ubuntu_16.04_lts (from the name)	from 2.61.4ubuntu0.16.04.1+esm2 not affected	CNA record
Canonical Ubuntu 18.04 LTS canonical:ubuntu_18.04_lts (from the name)	from 2.61.4ubuntu0.18.04.1+esm2 not affected	CNA record
Canonical Ubuntu 20.04 LTS canonical:ubuntu_20.04_lts (from the name)	from 2.67.1+20.04ubuntu1~esm1 not affected	CNA record
Canonical Ubuntu 22.04 LTS canonical:ubuntu_22.04_lts (from the name)	from 2.73+ubuntu22.04.1 not affected	CNA record
Canonical Ubuntu 24.04 LTS canonical:ubuntu_24.04_lts (from the name)	from 2.73+ubuntu24.04.2 not affected	CNA record
canonical ubuntu_linux canonical:ubuntu_linux	16.04; 18.04; 20.04; 22.04; 24.04	NVD

References

References

https://ubuntu.com/security/CVE-2026-3888	vdb-entry, issue-tracking, third-party-advisory
https://ubuntu.com/security/notices/USN-8102-1	vendor-advisory, third-party-advisory
https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888	technical-description, vendor-advisory, mitigation, third-party-advisory
https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root	technical-description, media-coverage, mitigation, third-party-advisory
https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt	technical-description, media-coverage, third-party-advisory
http://www.openwall.com/lists/oss-security/2026/03/18/1	mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.