CVE-2026-88264

MediumCVSS 5.6/10Last modified Sep 25, 2026

Description

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 10, 2026
Last modified
Sep 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-882655.6A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, thCVE-2026-882686.5GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash theCVE-2026-882696.5GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credCVE-2026-88278.2The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. ThCVE-2026-882706.5GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is vaCVE-2026-882718.8GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR.CVE-2026-882727.2GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commCVE-2026-882737.2GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute CVE-2026-882747.2GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root.CVE-2026-882757.2GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wirCVE-2026-882767.2GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root.CVE-2026-882778.8GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitra
CVE-2026-88264: Medium severity, CVSS 5.6 | Vulnix