USN-8579-1: snapd vulnerabilities

unknownCVE-2024-5300 CVE-2026-8933 CVE-2026-15226

James Henstridge discovered that snapd's default apparmor template did not restrict access to systemd-userdbd varlink interface. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2024-5300) Qualys discovered that snap-confine can be tricked to create attacker-controlled files at certain privileged locations. A local attacker could possibly use this issue to bypass intended restrictions and escalate privileges to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8933) Zygmunt Krynicki discovered that snapd's default seccomp template did not restrict the creation of executables with the set-user-ID attribute. A local attacker could possibly use this issue to create and execute setuid binaries. (CVE-2026-15226)

CSIRTS triage

vendor: null product: snapd Information disclosure Privilege escalationOtheraffected: Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS

What: Multiple vulnerabilities could allow local attackers to obtain sensitive information or escalate privileges.
Who is affected: Users of snapd on Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.
Urgency: Remediation is important due to the potential for information disclosure and privilege escalation.
Action: Update snapd to the latest version to mitigate these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch snapd

Get an email when a new snapd advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8579-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2024-53000.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.
Low exploitation riskCVE-2026-89330.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
Low exploitation riskCVE-2026-152260.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-5300	coverage & exploitation status	NVD · CVE.org
CVE-2026-8933	coverage & exploitation status	NVD · CVE.org
CVE-2026-15226	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.