CVE-2026-96812
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor…
- Risk score
- 53/100
- CVSS
- 8.8 v4.0
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character dev…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.
Last activity 25 Sep 2026. Patch Forecast updates every hour.