CVE-2026-76925

Received Received - Intake

Flatpak TOCTOU Race Condition in SystemHelper Component

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: redhat-SADP

Description

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-76925

Affected Vendors & Products

Vendor	Product	Version / Range
flatpak	flatpak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a Time-of-check to time-of-use (TOCTOU) race condition in Flatpak's org.freedesktop.Flatpak.SystemHelper component. It occurs because a privileged chmod operation runs before OSTree repository validation in the Deploy() function. An attacker can exploit the timing gap to redirect symlinks to arbitrary files, enabling unauthorized file manipulation or information disclosure.

Detection Guidance

Detecting CVE-2026-76925 requires checking for vulnerable Flatpak versions and analyzing system logs for suspicious symlink operations. Inspect Flatpak installations with 'flatpak --version' and compare against patched versions. Review system logs for unexpected chmod operations or symlink redirections in OSTree repositories.

Impact Analysis

If exploited, this flaw could allow an attacker with local access to modify files they shouldn't have permission to change. This might lead to data corruption, unauthorized access to sensitive information, or system instability. The impact depends on the attacker's goals and system configuration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file manipulation or information disclosure through a race condition in Flatpak's system helper component. Exploitation may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Flatpak to the latest version to ensure the TOCTOU race condition is patched. Monitor system logs for unusual file access or symlink redirection attempts. Restrict user privileges to minimize potential impact if exploitation occurs.

Hi! I’m here to help you understand CVE-2026-76925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70