CVE-2026-3888
CWE-268Published: March 17, 2026· Updated: Mar 18, 2026
Official Description
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Technical Analysis
CVE-2026-3888 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
News & Research Mentioning CVE-2026-3888
CVE-2026-3888 Ubuntu snap flaw lets local users escalate to root via timing-based exploit
A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level. Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system. "This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access [xlite_meta score:56 src:The Hacker News xlite_fp:d1e63020be341ca492dc78f6bc850cebafc9c501d6bafc4d137df92c371f7de6]
All References (6)
Quick Facts
Known Threat Actors
Related CVEs (CWE-268)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-3888 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts