Three vulnerabilities in snapd allow local attackers to escalate privileges: CVE-2024-5300 (CVSS 5.6) permits information disclosure via the systemd-userdbd interface, CVE-2026-8933 (CVSS 7.8) allows file creation at privileged locations on Ubuntu 22.04, 24.04, and 26.04 LTS, and CVE-2026-15226 (CVSS 8.4) enables the creation and execution of setuid binaries via an insufficient seccomp filter.
James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2024-5300) Qualys discovered that snap-confine can be tricked to create attacker-controlled files at certain privileged locations. A local attacker could possibly use this issue to bypass intended restrictions and escalate privileges to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8933) Zygmunt Krynicki discovered that snapd's default seccomp template did not restrict the creation of executables with the set-user-ID attribute. A local attacker could possibly use this issue to create and execute setuid binaries. (CVE-2026-15226)