CVE-2026-3888
Local Privilege Escalation in snapd
HIGH 7.8EPSS 0.5%
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Affected
- Canonical · snapd · Ubuntu 16.04 LTS · Ubuntu 18.04 LTS · Ubuntu 20.04 LTS · Ubuntu 22.04 LTS · Ubuntu 24.04 LTS
- CVSS v3.1 UBUNTU
- 7.8 HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.47% chance of exploitation in the next 30 days, 40th percentile
- Published
- 2026-03-17
- Updated
- 2026-03-18
Proof-of-concept exploits (9)
- netw0rk7/CVE-2026-3888-PoC3★ · 2026-03-23
- fevar54/CVE-2026-3888-POC-all-from-the-Qualys-platform.2★ · 2026-03-18
- Many-Hat-Group/Ubuntu-CVE-2026-3888-patcher0★ · 2026-03-19
- TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE19★ · 2026-03-23
- noambouillet/CVE-2026-38885★ · 2026-04-02
- DanielTangnes/CVE-2026-38880★ · 2026-05-19
- Rebick/CVEs_exploit0★ · 2026-05-13
- AlanNewberry/CVE-2026-3888-snap-confine-privilege-escalation1★ · 2026-10-06
- alinpfan/CVE-2026-3888-PoC0★ · 2026-10-12
Metasploit modules (1)
Security advisories
- http://www.openwall.com/lists/oss-security/2026/03/18/1
- https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-importan…
- https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
- https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888
- https://ubuntu.com/security/CVE-2026-3888
- https://ubuntu.com/security/notices/USN-8102-1