CVE-2026-49238: multipass before 1.16.3 (exclusive); +1 more affected products

Affected technology

multipass · before 1.16.3 (exclusive)
canonical

Multipass · 0 to before 1.16.3
Canonical

Description’s affected range: before version 1.16.3

Component: Not specified by the source
Function: in, performs

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with root privileges inside a guest virtual machine can bypass the FUSE layer by injecting raw SFTP frames (such as an SSH_FXP_OPEN request) directly into the sshfs_server process stdin/stdout pipes via procfs. Vendor/CNA’s CVSS 3.1 assessment (base score 8.4/10) rates confidentiality and integrity impact as high; availability impact as none.