fuse-overlayfs retains SUID and SGID bits when a file is truncated or reopened with the O_TRUNC flag in release‑1.x. This behaviour allows a non‑privileged process to leave an upper‑layer file with mode 4777, giving that file root privileges upon execution. The weakness is an improper access control for privilege bits (CWE‑266) and a failure to normalise file state after truncation (CWE‑281). The fix is implemented in versions 1.17 and newer.

All installations of fuse‑overlayfs older than version 1.17 that use the release‑1.x C branch are vulnerable. The flaw applies to rootless container environments where a user has write access to the overlay filesystem and can truncate or create files in the upper layer.

The CVSS score of 2 indicates a low severity rating. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker with local privileges inside a container or on the host filesystem that can access the overlay filesystem can exploit the flaw by truncating a file and ensuring it ends up with SUID/SGID root bits. The resulting file can then be executed to run commands with elevated privileges, creating a local privilege‑escalation path. No evidence from the CVE data indicates that this flaw directly allows host break‑out or container escape.