CVE-2026-8933

Published Jul 21, 2026

Last updated a month ago

CVSS high 7.8
Ubuntu

Overview

Description
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
Source
security@ubuntu.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

security@ubuntu.com
CWE-250

Social media

Hype score
Not currently trending

  1. 🐧 𝗔𝗟𝗘𝗥𝗧𝗔 𝗟𝗜𝗡𝗨𝗫: 2 fallas críticas de escalamiento de privilegios 🔹 CVE-2026-8933 → Ubuntu Desktop 🔹 CVE-2026-64600 "RefluXFS" → RHEL, CentOS, Rocky, AlmaLinux, Fedora, Amazon Linux Más info 👇👇 https://t.co/9PL0Ewg3GT #Ciberse

    @LeonelM41262107

    24 Jul 2026

    131 Impressions

    2 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2026-8933: a snap-confine flaw gives any local user root on default Ubuntu Desktop 24.04, 25.10 and 26.04. Ironically introduced by a 2025 least-privilege hardening change. Patch shipped Jul 21. https://t.co/4ElHRDxS2Y #cybersecurity #Linux

    @JNitterauer

    23 Jul 2026

    98 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. A critical flaw in Ubuntu's snap-confine component, CVE-2026-8933, allows local users to gain root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. This vulnerability stems from a race condition introduced during a security hardening change in July 2025.

    @dailytechonx

    23 Jul 2026

    113 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🔒💥 ¡ALERTA DE SEGURIDAD EN UBUNTU! Canonical revela 3 vulnerabilidades críticas en snapd que afectan versiones desde Ubuntu 16.04 LTS. CVE-2026-8933 permite escalado de privilegios. CVE-2026-15226 posibilita escape de confinación. CVE-2024-5300 expone contraseñas

    @DiarioBitcoin

    23 Jul 2026

    932 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  5. 🚨 High-Severity Ubuntu Alert Qualys TRU has disclosed CVE-2026-8933, a local privilege escalation in snap-confine that grants full root access to any unprivileged local user on default Ubuntu Desktop installations. The flaw arises from race conditions in temporary directory h

    @FriendOfTheInst

    22 Jul 2026

    112 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.•CVE-2026-79619
  2. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.•CVE-2026-63385
  3. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.•CVE-2026-63381
  4. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.•CVE-2026-63382
  5. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that.•CVE-2026-74529

References

Sources include official advisories and independent security research.