CVE-2026-8933

Name	CVE-2026-8933
Description	A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1142551

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
snapd (PTS)	bullseye, bullseye (security)	2.49-1+deb11u2	vulnerable
	bookworm, bookworm (security)	2.57.6-1+deb12u1	vulnerable
	trixie, trixie (security)	2.68.3-3+deb13u1	vulnerable
	forky, sid	2.76-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
snapd	source	(unstable)	(unfixed)			1142551

Notes

[trixie] - snapd <ignored> (Not exploitable as snap-confine not yet installed with set capabilities)
https://www.openwall.com/lists/oss-security/2026/07/21/1
https://www.openwall.com/lists/oss-security/2026/07/21/2
Non-suid snap-confine only introduced in debian/2.71-1