The vulnerability arises because snapconfine generates seccomp templates that fail to filter or block system calls responsible for creating or manipulating file execution flags with set‑user‑ID attributes. This oversight allows an application running inside a strictly confined snap to compile or drop binaries and apply setuid properties to them. Once a malicious or compromised process inside the snap executes these setuid binaries, it can escape sandbox confinement, potentially performing privileged actions within the container namespace that the sandbox otherwise prohibits. The weakness is classified as CWE‑250, reflecting that setuid binaries may be created or used erroneously.

The flaw affects Canonical’s snapd on Ubuntu releases 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS and 26.04 LTS. All versions shipped with the vulnerable snap‑confine implementation are impacted; specific affected snapd versions are not listed in the data.

The CVSS base score of 8.4 signals a high‑severity privilege escalation risk. The EPSS score of less than 1 % indicates that, while the vulnerability exists, the historical exploitation probability is very low, and the flaw is not currently included in the CISA KEV catalog. Attackers would need to run or inject malicious code through a snap package; from that position the sandbox bypass permits creation and execution of setuid binaries, circumventing confinement. Given the lack of a remote trigger, successful exploitation typically requires local access to the system and the ability to install or modify snaps.