CVE-2026-24843: File Write Vulnerability in Chainguard Melange

The core of this vulnerability lies in Melange's QEMU runner's file handling logic. Specifically, it fails to adequately restrict where files can be written during certain operations. An attacker who can control the input to the QEMU runner can craft malicious data that causes it to write files to locations outside the designated workspace. This could include overwriting critical system files, injecting malicious scripts, or creating backdoor accounts. The potential impact is significant, ranging from complete system compromise to data exfiltration, depending on the attacker's capabilities and the privileges of the user running Melange. Successful exploitation could allow an attacker to gain persistent access to the system.

1. Reserved2026-01-27
2. Published2026-02-05
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24843 is to upgrade Chainguard Melange to version 0.40.3 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing stricter workspace directory permissions to limit the potential damage from unauthorized file writes. Review and restrict the input data provided to the QEMU runner to prevent malicious payloads. Implement robust input validation and sanitization to ensure that only expected file names and paths are processed. After upgrading, verify the fix by attempting to write a file outside the designated workspace directory and confirming that the operation is denied.