{"id":"CVE-2026-52791","summary":"fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)","details":"fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.","aliases":["GHSA-2cc4-p72c-v85h"],"modified":"2026-07-31T08:04:52.200557Z","published":"2026-07-29T16:14:46.724Z","database_specific":{"cwe_ids":["CWE-266"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52791.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/containers/fuse-overlayfs/releases/tag/v1.17"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52791.json"},{"type":"ADVISORY","url":"https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52791"},{"type":"FIX","url":"https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/containers/fuse-overlayfs","events":[{"introduced":"0"},{"fixed":"97e0d968a782fc259ebde112db1e9b9ff1ad724f"},{"fixed":"efcfefa8032f27dfe922d1f75c4500b2dfc938f7"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.17"}]}}],"versions":["v1.11","v1.1.1","v0.7.6","v0.7.3","v0.7.2","v0.7.1","v0.7","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6","v0.5.2","v0.5.1","v0.5","v0.4.1","v0.4","v0.3","v0.2"],"database_specific":{"vanir_signatures_modified":"2026-07-31T08:04:52Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"267460716407572158293557451051315175875","length":3696},"id":"CVE-2026-52791-587b046d","signature_type":"Function","signature_version":"v1","source":"https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f","target":{"file":"main.c","function":"ovl_setattr"}},{"digest":{"line_hashes":["42953893317701153639833133081295480576","122230790176440400585180631013057014212","261338506841242052163220871608424544328","86279045804024468123578310475457621306","312009676293058268648021586546722102863","276971867368651183729708734637003476021","331659960761292771479430480320418223731","117708908557645446318061943503729415716","331217716789935016663026120131390046614","334223717641620675912299700038050698405","171975415672558706408903419607616338060","256907931672996763807154383568211614765","305612351628407432427160054197773213728","69158942589164361193561472309513833338","187609762407355986014853415208277029597","256907931672996763807154383568211614765","216468816517819873262629666651869276164","176162821401282323831365298291195758160","7352613058722750119148676478274777431"],"threshold":0.9},"id":"CVE-2026-52791-657be205","signature_type":"Line","signature_version":"v1","source":"https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f","target":{"file":"main.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"79964567950275437628207968565644430975","length":504},"id":"CVE-2026-52791-ce600281","signature_type":"Function","signature_version":"v1","source":"https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f","target":{"file":"main.c","function":"ovl_open"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52791.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}