CVE-2026-41163

A flaw was found in bubblewrap when operating in setuid mode. A local user may use ptrace to interfere with the sandbox setup process and gain access to privileged operations that are normally restricted. This could allow an attacker to bypass intended sandboxing restrictions and potentially elevate privileges on the system.

This vulnerability affects bubblewrap's setuid mode. During sandbox initialization, insufficient isolation between privileged and unprivileged processing stages allows a local attacker to manipulate the sandbox setup process using ptrace.

The vulnerability relies on support for overlay filesystem mounts. The overlayfs mount support was added in bubblewrap version 0.11.0 and that versions prior to 0.11.0 do not support overlay mounts.

Red Hat products currently ship bubblewrap versions that predate the introduction of overlay mount support. As a result, the vulnerable functionality is not present and Red Hat products are not affected by this issue.

Additionally, RHEL 8 and later install bubblewrap in non-setuid root mode by default. Since this vulnerability specifically affects the setuid mode, default Red Hat configurations should anyway will not expose to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.