Low 2.0Published Jul 29, 2026

CVE-2026-52791fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

Updated under an hour ago (Oct 27, 2026, 8:30 PM ET)

Does this affect you?

It affects containers fuse-overlayfs. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for containers fuse-overlayfs

Exploited in the last 30 days

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

CVSS: 2.0 LOW (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-266
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Jul 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

containers fuse-overlayfs containers:fuse_overlayfs (from the name)	before 1.17	CNA record

References

References

https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h	x-refsource-confirm
https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f	x-refsource-misc
https://github.com/containers/fuse-overlayfs/releases/tag/v1.17	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.