# CVE-2026-52791: containers fuse-overlayfs SUID bit preservation on truncate

Source: https://junglewise.ai/threats/cve-2026-52791-containers-fuse-overlayfs-suid-bit-preservation-on-truncate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-52791 · Severity: info · CVSS 2 · Published 2026-07-29

fuse-overlayfs is a tool used to manage file systems for rootless containers, allowing users to run containers without administrative privileges. A vulnerability exists where certain file operations (truncating a file) fail to remove special security permissions (SUID/SGID bits) as they should. This could allow a low-privileged user to maintain elevated permissions on a file unexpectedly, potentially leading to unauthorized privilege assignment within the container environment.

Vendors: [Containers](https://junglewise.ai/threats/vendors/containers).

## Quick answers

**Is CVE-2026-52791 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52791 being exploited in the wild.

**How severe is CVE-2026-52791?** Informational severity, with a CVSS score of 2, published 29 July 2026.

**Which products and versions are affected?** Containers Fuse-Overlayfs < 1.17.

**Is there a fix for CVE-2026-52791?** A patch was published on 2026-06-09: Fix committed and version 1.17 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52791 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-52791?** Check whether you run Containers Fuse-Overlayfs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the C implementation of fuse-overlayfs (release-1.x branch) occurs because the program preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate operations. While standard write operations correctly clear these bits, the truncate path fails to do so when a file is copied up to the upper layer. A local, low-privileged attacker can exploit this by truncating a writable file through the merged mount, resulting in an upper-layer file that retains elevated privileges (e.g., mode 4777). This issue is specific to the C-based release branch and does not affect the Rust rewrite. The vulnerability is fixed in version 1.17 by explicitly clearing these bits during truncation.

## Affected products

- containers fuse-overlayfs < 1.17

## Timeline

- 2026-06-09: patched: Fix committed and version 1.17 released
- 2026-07-29: disclosed: Public advisory and CVE published

## References

- [https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f](https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f)
- [https://github.com/containers/fuse-overlayfs/releases/tag/v1.17](https://github.com/containers/fuse-overlayfs/releases/tag/v1.17)
- [https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h](https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h)