CVE-2026-88838
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Oct 13, 2026
CISA due date
—
The record
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113730 OGNL is an Object Graph Navigation Library for Java. CWE-693
- CVE-2026-112077 A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. CWE-693
- CVE-2026-101899 Axios is a promise-based HTTP client for the browser and Node.js. CWE-693
- CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-693
- CVE-2026-107697 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that… CWE-693
- CVE-2026-105083 ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in… CWE-693
- CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. CWE-693
- CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the… CWE-693