{"id":"CVE-2026-96812","published":"2026-09-25T15:17:57.097","lastModified":"2026-09-25T17:17:20.543","description":"Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-269","CWE-668"],"vendors":[],"products":[],"references":[{"url":"https://github.com/google/gvisor/commit/573a9e73cf844f","tags":[]}],"exploitRefs":[{"url":"https://github.com/google/gvisor/commit/573a9e73cf844f","tags":[]}],"hasPoc":true,"ai":null}