A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations).
Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-250

https://ubuntu.com/security/CVE-2026-8933

[{"defaultStatus":"unaffected","collectionURL":"https://github.com/canonical","packageName":"snapd","repo":"https://github.com/canonical/snapd/","versions":[{"version":"2.75.0","lessThan":"2.76.1","versionType":"semver","status":"affected"}]},{"vendor":"Canonical","product":"Ubuntu 26.04 LTS","defaultStatus":"affected","collectionURL":"https://launchpad.net/ubuntu/resolute","packageName":"snapd","platforms":["Linux"],"repo":"https://launchpad.net/ubuntu/+source/snapd","versions":[{"version":"2.76+ubuntu26.04.3","versionType":"dpkg","status":"unaffected"}]},{"vendor":"Canonical","product":"Ubuntu 24.04 LTS","defaultStatus":"affected","collectionURL":"https://launchpad.net/ubuntu/noble","packageName":"snapd","platforms":["Linux"],"repo":"https://launchpad.net/ubuntu/+source/snapd","versions":[{"version":"2.76+ubuntu24.04.1","versionType":"dpkg","status":"unaffected"}]},{"vendor":"Canonical","product":"Ubuntu 22.04 LTS","defaultStatus":"affected","collectionURL":"https://launchpad.net/ubuntu/jammy","packageName":"snapd","platforms":["Linux"],"repo":"https://launchpad.net/ubuntu/+source/snapd","versions":[{"version":"2.76+ubuntu22.04.1","versionType":"dpkg","status":"unaffected"}]}]