CVE-2026-86469— Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 GLib2 中发现了一个漏洞。当 使用 标志时，如果创建 临时文件失败，该库会删除（unlink）目标文件并重新创建它，但此过程既未使用“独占创建”（exclusive creation），也未提供符号链接（symlink）保护。因此，能够写入目标目录的本地攻击者可以利用这一竞态条件（race condition），将写入操作重定向到另一个文件。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 11
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Hardened Images | any |
affected |
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86469
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-86469
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86469
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86469 (2)
-
-
🔗 2473839 – (CVE-2026-86469) CVE-2026-86469 glib2: TOCTOU Symlink Race in `G_FILE_CREATE_REPLACE_DESTINATION` Fallback Path Read full article issue-tracking x_refsource_REDHAT
Other References for CVE-2026-86469 (2)
Same Patch Batch · Red Hat · 2026-09-07 · 10 CVEs total
| CVE-2026-18922 | 9.8 CRITICAL | 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directo |
| CVE-2026-76578 | 9.8 CRITICAL | Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials vi |
| CVE-2026-86404 | 8.8 HIGH | Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging- |
| CVE-2026-19843 | 8.4 HIGH | 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console l |
| CVE-2026-79678 | 8.1 HIGH | Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environm |
| CVE-2026-18453 | 7.5 HIGH | 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results an |
| CVE-2026-18355 | 7.5 HIGH | 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound |
| CVE-2026-76560 | 7.5 HIGH | 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empt |
| CVE-2026-86332 | 6.5 MEDIUM | Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-79678
Freeipa: idm: freeipa: idp-add eval() reachable before autho -
CVE-2026-76578
Ipa: freeipa: freeipa: unauthenticated ldap client can obtai -
CVE-2026-76925
Flatpak: flatpak: toctou race condition allows symlink redir -
CVE-2026-85769
Libtpms: libtpms: heap out-of-bounds read in tpm2 state unma -
CVE-2026-85534
Libsoup: libsoup: http/2 client crash in on_data_source_read
Same vendor: Red Hat
-
CVE-2026-74859
Gnome-tweaks: path traversal in theme installer -
CVE-2026-76561
Pki-core: dogtag/pki: certprofile-import allows code executi -
CVE-2026-19843
389-ds-base: 389-ds-base: command injection via unescaped ld -
CVE-2026-18922
389-ds-base: 389-ds-base: sasl plain authentication allows p -
CVE-2026-18453
389-ds-base: 389-ds-base: pre-authentication null pointer de
Same weakness: CWE-59
-
CVE-2026-86424
ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlin -
CVE-2026-86422
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race -
CVE-2026-85583
SiYuan before v3.8.2 Path Traversal via symlink in file API -
CVE-2026-85092
LiME through 1.12.0 Arbitrary File Overwrite via Symlink Fol -
CVE-2026-78409
Util-linux: util-linux: x-mount.subdir detached-tree resolut
V. Comments for CVE-2026-86469
No comments yet