UBUNTU-CVE-2026-32116

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-32116
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-32116
Upstream
Published
2026-03-12T18:16:00Z
Modified
2026-05-20T16:25:20Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, receiving a file (wormhole receive) from a malicious party could result in overwriting critical local files, including ~/.ssh/authorized_keys and .bashrc. This could be used to compromise the receiver's computer. Only the sender of the file (the party who runs wormhole send) can mount the attack. Other parties (including the transit/relay servers) are excluded by the wormhole protocol. This vulnerability is fixed in 0.23.0.

References

Affected packages

Ubuntu:18.04:LTS
magic-wormhole

Package

Name
magic-wormhole
Purl
pkg:deb/ubuntu/magic-wormhole?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.1-1
0.10.3-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "magic-wormhole",
            "binary_version": "0.10.3-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json"
Ubuntu:20.04:LTS
magic-wormhole

Package

Name
magic-wormhole
Purl
pkg:deb/ubuntu/magic-wormhole?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.11.2-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "magic-wormhole",
            "binary_version": "0.11.2-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json"
Ubuntu:22.04:LTS
magic-wormhole

Package

Name
magic-wormhole
Purl
pkg:deb/ubuntu/magic-wormhole?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.12.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "magic-wormhole",
            "binary_version": "0.12.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json"
Ubuntu:24.04:LTS
magic-wormhole

Package

Name
magic-wormhole
Purl
pkg:deb/ubuntu/magic-wormhole?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.12.0-1.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "magic-wormhole",
            "binary_version": "0.12.0-1.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json"
Ubuntu:25.10
magic-wormhole

Package

Name
magic-wormhole
Purl
pkg:deb/ubuntu/magic-wormhole?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.18.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "magic-wormhole",
            "binary_version": "0.18.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json"
Ubuntu:26.04:LTS
magic-wormhole

Package

Name
magic-wormhole
Purl
pkg:deb/ubuntu/magic-wormhole?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.18.0-1
0.18.0-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "magic-wormhole",
            "binary_version": "0.18.0-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-32116.json"