Bubblewrap

This hub aggregates every CVE we track for Bubblewrap, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 6 most recently published vulnerabilities affecting Bubblewrap.

• CVE-2026-41163bubblewrap vulnerable to privilege escalation in setuid mode via ptrace7.0May 9, 2026
• CVE-2021-4034A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users acc...KEV7.8Jan 28, 2022
• CVE-2020-5291Privilege escalation in setuid mode via user namespaces in Bubblewrap7.2Mar 31, 2020
• CVE-2019-12439bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw ...7.4May 29, 2019
• CVE-2017-5226When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an...10.0Mar 29, 2017
• CVE-2016-8659Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.7.0Feb 13, 2017