Improper privilege management in Bubblewrap - CVE-2026-41163

Vulnerability identifier: #VU126913

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41163

CWE-ID: CWE-269

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper access control in setuid mode when handling ptrace attachment during the sandbox setup phase. A local user can attach to bubblewrap with ptrace and control the unprivileged part of the sandbox setup phase to escalate privileges.

Only installations running in setuid mode are vulnerable, and exploitation is possible in configurations that support overlayfs mounts.

Bubblewrap
Gentoo Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Basesystem Module
openSUSE Leap
Ubuntu
bubblewrap (Ubuntu package)
bubblewrap-debugsource
bubblewrap-zsh-completion
bubblewrap
bubblewrap-debuginfo
sys-apps/bubblewrap

Install security update from vendor's website.

Bubblewrap - update to 0.11.2
bubblewrap (Ubuntu package) - addressed in versions 0.11.0-2ubuntu0.1, 0.11.1-1ubuntu0.1
bubblewrap-debugsource - update to 0.11.0-150500.3.12.1
bubblewrap-zsh-completion - update to 0.11.0-150500.3.12.1
bubblewrap - update to 0.11.0-150500.3.12.1
bubblewrap-debuginfo - update to 0.11.0-150500.3.12.1
sys-apps/bubblewrap - update to 0.11.2

• https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp

• Improper privilege management in Bubblewrap
• Ubuntu update for bubblewrap
• SUSE update for bubblewrap
• Gentoo update for Bubblewrap