bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
CVE-2019-12439
CVSS base score
7.4 (v3.0)
Severity
HIGH
Attack vector
Local
Weakness
CWE-20
Last modified
November 2, 2026
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
projectatomic bubblewrap
References
- lists.opensuse.org
- lists.opensuse.org
- access.redhat.com
- bugzilla.redhat.com Issue Tracking, Third Party Advisory
- github.com Patch, Third Party Advisory
- github.com Third Party Advisory
- github.com Release Notes, Third Party Advisory
- security.gentoo.org
- lists.opensuse.org
- lists.opensuse.org