PT-2026-35169 · Unknown · Bubblewrap

Fdiakh · Published 2026-04-23 · Updated 2026-05-20 · CVE-2026-41163

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bubblewrap versions 0.11.0 through 0.11.1

Description Privilege escalation is possible if the software is installed as setuid root, occurring via ptrace (a system call used for process tracing and debugging).

Recommendations Update to version 0.11.2 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-41163

OPENSUSE-SU-2026:10671-1

USN-8288-1

Affected Products

Bubblewrap

References · 19

• https://ubuntu.com/security/notices/USN-8288-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41163 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10671-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41163 · Security Note
• https://osv.dev/vulnerability/USN-8288-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41163 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41163 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41163 · Vendor Advisory
• https://github.com/containers/bubblewrap/releases/tag/v0.11.2 · Note
• https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp · Note
• https://suse.com/security/cve/CVE-2026-41163 · Note
• https://twitter.com/CVEarity/status/2053763521100632115 · Twitter Post
• https://twitter.com/nanovms/status/2048073463806783857 · Twitter Post
• https://twitter.com/oss_security/status/2048946733778866334 · Twitter Post