PT-2026-35169 · Unknown · Bubblewrap

Fdiakh · CVE-2026-41163 · Published 2026-04-23 · Updated 2026-05-20

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bubblewrap versions 0.11.0 through 0.11.1

Description Privilege escalation is possible if the software is installed as setuid root, occurring via ptrace (a system call used for process tracing and debugging).

Recommendations Update to version 0.11.2 or later.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-41163

GHSA-XQ78-7HW4-5JVP

OPENSUSE-SU-2026:10671-1

OPENSUSE-SU-2026:20811-1

SUSE-SU-2026:2094-1

SUSE-SU-2026:21847-1

USN-8288-1

Affected Products

Bubblewrap

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41163.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:10671-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-41163 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8288-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41163 · Security Note
• https://osv.dev/vulnerability/USN-8288-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41163 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41163 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41163 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41163 · Vendor Advisory
• https://github.com/containers/bubblewrap/security/advisories/GHSA-xq78-7hw4-5jvp · Note
• https://github.com/containers/bubblewrap/releases/tag/v0.11.2 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41163.json · Note