CVE-2021-3626

8.8 highEPSS 0.2%

High (8.8) in canonical multipass. EPSS 0.2% chance of exploitation in the next 30 days.

The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWEs: CWE-73, CWE-284
Published: 2021-10-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:multipass

References

https://github.com/canonical/multipass/pull/2150
https://github.com/canonical/multipass/pull/2150

Check your stack JSON