The vulnerability in libfuse occurs during io_uring queue initialization when the code incorrectly handles failures from NUMA allocation or queue registration. A NULL pointer is dereferenced, and memory allocated during the process is not freed if registration fails, leading to a crash of the FUSE daemon or resource exhaustion. The flaw is a classic null pointer dereference and memory leak (CWE‑476).

The issue affects libfuse versions 3.18.0 up to, but not including, 3.18.2. Only the io_uring transport path is impacted; the traditional /dev/fuse interface remains safe. The affected product is the libfuse reference implementation used on Linux systems.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Attackers must be able to run code locally on the target machine to trigger the fault, typically by creating or manipulating a filesystem that uses io_uring. If exploited, the daemon would crash or run out of memory, effectively disabling the FUSE mount for the local user.