Quick answers
- Is CVE-2026-52791 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52791 being exploited in the wild.
- How severe is CVE-2026-52791?
- Informational severity, with a CVSS score of 2, published 29 July 2026.
- Which products and versions are affected?
- Containers Fuse-Overlayfs < 1.17.
- Is there a fix for CVE-2026-52791?
- A patch was published on 2026-06-09: Fix committed and version 1.17 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52791 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-52791?
- Check whether you run Containers Fuse-Overlayfs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability in the C implementation of fuse-overlayfs (release-1.x branch) occurs because the program preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate operations. While standard write operations correctly clear these bits, the truncate path fails to do so when a file is copied up to the upper layer. A local, low-privileged attacker can exploit this by truncating a writable file through the merged mount, resulting in an upper-layer file that retains elevated privileges (e.g., mode 4777). This issue is specific to the C-based release branch and does not affect the Rust rewrite. The vulnerability is fixed in version 1.17 by explicitly clearing these bits during truncation.
Affected products
- containers fuse-overlayfs < 1.17
Timeline
- 2026-06-09: patched: Fix committed and version 1.17 released
- 2026-07-29: disclosed: Public advisory and CVE published