CVE-2025-66002CWE-88

CVE-2025-66002

published January 8, 2026

CVSS

6.9

EPSS

Percentile

4.5

In the wild

Unconfirmed

What it is

An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper

The record

Technical detail

CVSS: 6.9 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00158 · 4.5th percentile
Weakness: CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published: 2026-01-08T20:15Z

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-66002 · [email protected]https://security.opensuse.org/2025/12/10/smb4k-major-issues-in-kauth-helper.html · [email protected]

EPSS history

Timeline

08 JAN 14:25Z
Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation
cvelistv5