FUSE-Rust: Uninitalized memory read and leak caused by fuser crate

During the creation of a new libfuse session with fusesessionnew, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so...

acid-store (>=0.12.0 <=0.14.2), aliyundrive-fuse (>=0.1.0 <=0.1.14) +34 more potentially affected by unknown CVE via fuser (>=0.10.0 <=0.15.1)

fuser CARGO version =0.10.0, =0.12.0, =0.1.0, =1.0.0, =0.1.0, =0.6.0, =1.6.0, =0.2.5, =0.1.2, =0.8.0, =0.8.2 - iso9660 =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CVMJ-47V9-35M9...

PT-2025-49034

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to a livelock in synchronous file put operations from fuseblk workers. This issue can lead to a hang when running tests that involve opening a...

CVE-2024-49730

In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FS

...

PT-2025-35620

Name of the Vulnerable Software and Affected Versions: versions prior to 2.3 Description: The software contains a possible out-of-bounds write due to memory corruption in FuseDaemon.cpp. This issue could lead to local escalation of privilege without requiring additional execution privileges or us...

CVE-2025-53813

The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted permissions...

CVE-2025-9190 TCC Bypass via misconfigured Node fuses in Cursor

The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted permission...

CVE-2025-9190 TCC Bypass via misconfigured Node fuses in Cursor

The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted permission...

CVE-2025-53813 TCC Bypass via misconfigured Node fuses in Nozbe

The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted permissions...

CVE-2025-53813

CVE-2025-53813 affects Nozbe on macOS due to a misconfiguration of the RunAsNode fuse, enabling a local unprivileged attacker to execute code that inherits Nozbe TCC permissions. Acquired resources are limited to user-granted permissions; other access requires a system prompt. The issue is fixed ...

CVE-2025-53813 TCC Bypass via misconfigured Node fuses in Nozbe

The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted permissions...

CVE-2025-53811 TCC Bypass via misconfigured Node fuses in Mosh-Pro

The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted...

CVE-2025-53811 TCC Bypass via misconfigured Node fuses in Mosh-Pro

The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC Transparency, Consent, and Control permissions. Acquired resource access is limited to previously granted...

PT-2025-34759 · Cursor · Cursor

Name of the Vulnerable Software and Affected Versions: Cursor version 15.4.1 Description: The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC Transparency, Consent, and...

PT-2025-34756 · Nozbe · Nozbe

Name of the Vulnerable Software and Affected Versions: Nozbe versions prior to 2025.11 Description: The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC Transparency,...

Linux Distros Unpatched Vulnerability : CVE-2016-2853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The aufs module for the Linux kernel 3.x and 4.x does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an aufs...

Linux Distros Unpatched Vulnerability : CVE-2025-38357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse: fix runtime warning on truncatefoliobatchexceptionals The WARNONONCE is introduced on...

Linux Distros Unpatched Vulnerability : CVE-2024-38626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse: clear FRSENT when re-adding requests into pending list The following warning was...

Linux Distros Unpatched Vulnerability : CVE-2021-28950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in fs/fuse/fusei.h in the Linux kernel before 5.11.8. A stall on CPU can occur because a retry loop continually finds the same bad inode...