CVE-2026-87766

EUVD-2026-74778
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.69%
Debian logo
Debian Releases
Debian Product
Codename
bubblewrap
bookworm
ignored
bookworm (security)
vulnerable
bullseye
ignored
forky
0.13.1-1
fixed
sid
0.13.1-1
fixed
trixie
0.12.0-1~deb13u1
fixed
trixie (security)
0.12.0-1~deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bubblewrap
bionic
needed
focal
needed
jammy
needed
noble
needed
resolute
needed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
bubblewrap
RHEL 9
0:0.6.3-1.el9_8.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
bubblewrap
Amazon Linux 2023
0:0.12.0-1.amzn2023.0.1
fixed
bubblewrap-debuginfo
Amazon Linux 2023
0:0.12.0-1.amzn2023.0.1
fixed
bubblewrap-debugsource
Amazon Linux 2023
0:0.12.0-1.amzn2023.0.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
bubblewrap
Azure Linux 3.0
0:0.12.0-1.azl3
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://access.redhat.com/errata/RHSA-2026:85306
https://access.redhat.com/errata/RHSA-2026:85308
https://access.redhat.com/errata/RHSA-2026:85309
https://access.redhat.com/errata/RHSA-2026:85312
https://access.redhat.com/errata/RHSA-2026:85313
https://access.redhat.com/errata/RHSA-2026:85317
https://access.redhat.com/errata/RHSA-2026:85319
https://access.redhat.com/errata/RHSA-2026:85322
https://access.redhat.com/errata/RHSA-2026:85324
https://access.redhat.com/errata/RHSA-2026:85325
https://access.redhat.com/security/cve/CVE-2026-87766
https://bugs.debian.org/1145655
https://bugzilla.redhat.com/show_bug.cgi?id=2530542
https://github.com/containers/bubblewrap/releases/tag/v0.12.0
https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx
https://www.openwall.com/lists/oss-security/2026/08/27/7
http://www.openwall.com/lists/oss-security/2026/09/09/3
http://www.openwall.com/lists/oss-security/2026/09/22/23