CVE-2025-66002 MEDIUM

CVE-2025-66002: Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation

Vendor Https://Github.com/Kde/

Product smb4k

Weakness CWE-88

Published January 8, 2026

Last update January 8, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper

Key dates

02Disclosure timeline

January 8, 2026 CVE published

January 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-66002 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/88.html

Related vulnerabilities

CVE-2025-66002: Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation

01Description

02Disclosure timeline

03References

04Related CVE