CVE-2026-8933 snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup
Local attackers can escalate privileges to root in Ubuntu systems using snap-confine with set-capabilities due to a flaw in execution environment setup.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8933?
CVE-2026-8933 is a high-severity vulnerability in Canonical Ubuntu 22.04 LTS, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
Weakness: CWE-250
Which versions are affected by CVE-2026-8933?
How do I fix CVE-2026-8933?
Apply the vendor's patch.
Is CVE-2026-8933 being exploited?
There is no known exploitation of CVE-2026-8933 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-8933, GHSA-fxqr-j4gx-622c, UBUNTU-CVE-2026-8933.