CVE-2026-16526
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-16526 is a high-severity File Descriptor Leak (CWE-403) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-50971
Vulnerability Data
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Maintains separate execution domains so file descriptors cannot be unintentionally inherited by child processes.
Prevents unintended information transfer via shared file descriptors between parent and child processes.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code reviews and static analysis that catch file-descriptor leaks before child-process invocation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure SDLC practices include code reviews and static analysis that can detect leaked descriptors.
Secure coding rules require closing inherited file descriptors before spawning child processes.
Security testing can uncover descriptor leaks but does not prevent them by itself.