ZeroDay Findings
Sign inSign up

Findings

CVE-2026-104715

A flaw was found in cifs-utils.

Published Oct 16, 2026 · updated Oct 16, 2026

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · NIST NVD

    Detected

    A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allo

  2. Oct 16, 2026 · OSV.dev

    Fix available

    cifs-utils fixed in 2:7.4-1+deb13u1

  3. Oct 16, 2026 · OSV.dev

    Fix available

    cifs-utils fixed in 2:7.4-1+deb13u1

  4. Oct 16, 2026 · OSV.dev

    Updated

    A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allo

Affected

  • Debian:12 cifs-utils2:7.0-2, 2:7.0-2.1, 2:7.1-1
  • Debian:13 cifs-utils0 → 2:7.4-1+deb13u1
  • Debian:14 cifs-utils2:7.4-1, 2:7.8-1, 2:7.9-1

Sources

  • NIST NVDVulnerability recordCVE-2026-104715

    A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-104715
    osv.dev

References