What’s Vulnerable › Vulnerabilities

CVE-2022-25328: Privilege escalation through command injection in fscrypt

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-25 · updated 2026-06-17
• Weakness: CWE-78

Description

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above

Affected products

• Google LLC fscrypt: before 0.3.3 — fixed in 0.3.3

How to fix

Upgrade to a fixed version: Google LLC fscrypt 0.3.3. Check the vendor advisory for mitigations.

References

• https://github.com/google/fscrypt/pull/346
• https://github.com/google/fscrypt/pull/346

Get alerted when CVE-2022-25328 or the next vulnerability affects your stack