Is CVE-2026-39461 actively exploited?

No active exploitation of CVE-2026-39461 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-39461 be exploited remotely?

No. CVE-2026-39461 requires local access to exploit.

What is the CVSS score of CVE-2026-39461?

CVE-2026-39461 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-39461

HIGH

CVE-2026-39461

CWE-121Published: May 21, 2026· Updated: May 21, 2026

8.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.3th

Official Description

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024).

An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges.

NVD Source

Technical Analysis

CVE-2026-39461 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.