CVE-2026-96812
High
Description
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.
SeverityHigh
CVSS8.8
Exploit probability—
Product
gVisor
PublishedSep 25, 2026
First seenSep 25, 2026
Weakness typeCWE-668CWE-668CWE-269Improper privilege management
How to fix
Update
- Google gVisor573a9e73cf844f or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google gVisor | v < 573a9e73cf844f | 573a9e73cf844f |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.