CVE-2026-86469

No indexed exploits for CVE-2026-86469 yet

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.

Affected products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Openshift Container Platform 4

CVSS 3.1: 5.3 MEDIUM
EPSS: 0.1% (2th percentile)
Weakness: CWE-59
NVD status: Awaiting Analysis
Published: 2026-09-07

Workaround

Do not use g_file_replace(..., G_FILE_CREATE_REPLACE_DESTINATION) on paths in directories writable by less-privileged users.

CVE-2026-86469 at NVD

Authoritative description, scoring and affected products

No exploit for CVE-2026-86469 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.