{"uuid": "7662c37c-b563-4f7a-b24e-ef54729cd26e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-3888", "type": "seen", "source": "https://gist.github.com/alon710/fd2ccd5d6fcb2bc32573ddafa189b58f", "content": "# CVE-2026-3888: CVE-2026-3888: Local Privilege Escalation in snapd via systemd-tmpfiles\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-03-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-3888\n\n## Summary\nCVE-2026-3888 is a critical local privilege escalation vulnerability arising from the insecure interaction between Canonical's snap-confine helper binary and systemd-tmpfiles within the world-writable /tmp directory.\n\n## TL;DR\nAn interaction flaw between snap-confine and systemd-tmpfiles allows a local unprivileged attacker to take control of tracking directories in /tmp after they are cleaned up, permitting sandbox escape and host root access.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-268\n- **Attack Vector**: Local\n- **CVSS Score**: 7.8\n- **EPSS Score**: 0.00383\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ubuntu Desktop 24.04 LTS\n- Ubuntu Desktop 25.10\n- Any system running snapd with cleanup configurations active in /tmp\n- **snapd**: < 2.73+ubuntu24.04.2 (Fixed in: `2.73+ubuntu24.04.2`)\n- **snapd**: < 2.73+ubuntu25.10.1 (Fixed in: `2.73+ubuntu25.10.1`)\n\n## Mitigation\n\n- Upgrade snapd to a patched version\n- Add manual exclusion rules to systemd-tmpfiles configuration\n\n**Remediation Steps:**\n1. Run command: sudo apt update && sudo apt install --only-upgrade snapd\n2. Verify snapd package version is 2.73+ubuntu24.04.2 (Ubuntu 24.04) or newer\n3. If patching is not possible immediately, edit /usr/lib/tmpfiles.d/snapd.conf to add exclusion rules\n4. Restart systemd-tmpfiles-clean.service\n\n## References\n\n- [Official Qualys Technical Advisory](https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt)\n- [Qualys Threat Research Blog](https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-3888) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T10:32:52.848216Z"}