p PatchFirst

CVE-2026-86469

CVE-2026-86469 · Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.

CVSS 5.3 · Medium · EPSS 0.1%

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • red hat enterprise linux 9

    No fix published

  • red hat hardened images

    No fix published

  • red hat openshift container platform 4

    No fix published

  • glib2.0 Debian:12

    Versions
    • 2.74.6-2
    • 2.74.6-2+deb12u1
    • 2.74.6-2+deb12u2
    • 2.74.6-2+deb12u3
    • 2.74.6-2+deb12u4
    • 2.74.6-2+deb12u5
    • 2.74.6-2+deb12u6
    • 2.74.6-2+deb12u7
    • 2.74.6-2+deb12u8
    • 2.74.6-2+deb12u9
    • 2.75.0-1
    • 2.75.2-1
    • 2.75.3-1
    • 2.75.3-2
    • 2.75.3-3
    • 2.75.4-1
    • 2.76.0-1
    • 2.76.1-1
    • 2.76.2-1
    • 2.76.3-1
    • 2.76.4-1
    • 2.76.4-2
    • 2.76.4-3
    • 2.76.4-4
    • 2.77.0-1
    • 2.77.1-1
    • 2.77.1-2
    • 2.77.2-1
    • 2.77.3-1
    • 2.78.0-1
    • 2.78.0-2
    • 2.78.1-1
    • 2.78.1-2
    • 2.78.1-3
    • 2.78.1-4
    • 2.78.2-1
    • 2.78.3-1
    • 2.78.3-2
    • 2.78.4-1
    • 2.78.4-2
    • 2.78.4-2.1
    • 2.78.4-3
    • 2.78.4-4
    • 2.78.4-5
    • 2.78.4-6
    • 2.78.4-7
    • 2.79.0+git20240110~g38f5ba3c-1
    • 2.79.0+git20240110~g38f5ba3c-2
    • 2.79.0+git20240119~62ee8bf6-1
    • 2.79.1-1
    • 2.79.1-1.1~exp1
    • 2.79.2-1
    • 2.79.3-1
    • 2.79.3-2
    • 2.79.3-3
    • 2.80.0-1
    • 2.80.0-10
    • 2.80.0-2
    • 2.80.0-3
    • 2.80.0-4
    • 2.80.0-5
    • 2.80.0-6
    • 2.80.0-7
    • 2.80.0-8
    • 2.80.0-9
    • 2.80.1-1
    • 2.80.2-1
    • 2.80.2-2
    • 2.80.3-1
    • 2.80.4-1
    • 2.81.0-1
    • 2.81.1-1
    • 2.81.1-2
    • 2.81.1-3
    • 2.81.2-1
    • 2.82.0-1
    • 2.82.0-2
    • 2.82.1-1
    • 2.82.2-1
    • 2.82.2-2
    • 2.82.2-3
    • 2.82.3-1
    • 2.82.3-2
    • 2.82.4-1
    • 2.82.4-2
    • 2.83.2-1
    • 2.83.2-2
    • 2.83.3-1
    • 2.83.3-2
    • 2.83.4-1
    • 2.83.5-1
    • 2.84.0-1
    • 2.84.0-2
    • 2.84.1-1
    • 2.84.1-2
    • 2.84.1-3
    • 2.84.2-1
    • 2.84.3-1
    • 2.84.4-1
    • 2.84.4-2
    • 2.84.4-3
    • 2.84.4-3~deb13u1
    • 2.84.4-3~deb13u2
    • 2.84.4-3~deb13u3
    • 2.84.4-3~deb13u4
    • 2.84.4-3~deb13u5
    • 2.85.1-1
    • 2.85.1-2
    • 2.85.2-2
    • 2.85.3-1
    • 2.85.4-1
    • 2.86.0-1
    • 2.86.0-2
    • 2.86.0-3
    • 2.86.0-4
    • 2.86.0-5
    • 2.86.0-6
    • 2.86.0-7
    • 2.86.1-1
    • 2.86.1-2
    • 2.86.2-1
    • 2.86.3-1
    • 2.86.3-2
    • 2.86.3-3
    • 2.86.3-4
    • 2.86.3-5
    • 2.87.1-1
    • 2.87.2-1
    • 2.87.2-2
    • 2.87.2-3
    • 2.87.3-1
    • 2.87.3~gitlab0-1
    • 2.87.5-1
    • 2.88.0-1
    • 2.88.1-2
    • 2.88.2-1
    • 2.88.3-1
    • 2.88.3-2
    • 2.88.3-3
    • 2.89.2-1
    • 2.89.3-1
    • 2.89.3-2
    • 2.89.3-3
    • 2.89.3-4
    • 2.89.3-5
    • 2.89.4-2
    • 2.90.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Debian:13

    Versions
    • 2.84.3-1
    • 2.84.4-1
    • 2.84.4-2
    • 2.84.4-3
    • 2.84.4-3~deb13u1
    • 2.84.4-3~deb13u2
    • 2.84.4-3~deb13u3
    • 2.84.4-3~deb13u4
    • 2.84.4-3~deb13u5
    • 2.85.1-1
    • 2.85.1-2
    • 2.85.2-2
    • 2.85.3-1
    • 2.85.4-1
    • 2.86.0-1
    • 2.86.0-2
    • 2.86.0-3
    • 2.86.0-4
    • 2.86.0-5
    • 2.86.0-6
    • 2.86.0-7
    • 2.86.1-1
    • 2.86.1-2
    • 2.86.2-1
    • 2.86.3-1
    • 2.86.3-2
    • 2.86.3-3
    • 2.86.3-4
    • 2.86.3-5
    • 2.87.1-1
    • 2.87.2-1
    • 2.87.2-2
    • 2.87.2-3
    • 2.87.3-1
    • 2.87.3~gitlab0-1
    • 2.87.5-1
    • 2.88.0-1
    • 2.88.1-2
    • 2.88.2-1
    • 2.88.3-1
    • 2.88.3-2
    • 2.88.3-3
    • 2.89.2-1
    • 2.89.3-1
    • 2.89.3-2
    • 2.89.3-3
    • 2.89.3-4
    • 2.89.3-5
    • 2.89.4-2
    • 2.90.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Debian:14

    Versions
    • 2.84.3-1
    • 2.84.4-1
    • 2.84.4-2
    • 2.84.4-3
    • 2.84.4-3~deb13u1
    • 2.84.4-3~deb13u2
    • 2.84.4-3~deb13u3
    • 2.84.4-3~deb13u4
    • 2.84.4-3~deb13u5
    • 2.85.1-1
    • 2.85.1-2
    • 2.85.2-2
    • 2.85.3-1
    • 2.85.4-1
    • 2.86.0-1
    • 2.86.0-2
    • 2.86.0-3
    • 2.86.0-4
    • 2.86.0-5
    • 2.86.0-6
    • 2.86.0-7
    • 2.86.1-1
    • 2.86.1-2
    • 2.86.2-1
    • 2.86.3-1
    • 2.86.3-2
    • 2.86.3-3
    • 2.86.3-4
    • 2.86.3-5
    • 2.87.1-1
    • 2.87.2-1
    • 2.87.2-2
    • 2.87.2-3
    • 2.87.3-1
    • 2.87.3~gitlab0-1
    • 2.87.5-1
    • 2.88.0-1
    • 2.88.1-2
    • 2.88.2-1
    • 2.88.3-1
    • 2.88.3-2
    • 2.88.3-3
    • 2.89.2-1
    • 2.89.3-1
    • 2.89.3-2
    • 2.89.3-3
    • 2.89.3-4
    • 2.89.3-5
    • 2.89.4-2
    • 2.90.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.38.0-1ubuntu1
    • 2.38.1-1
    • 2.39.1-0ubuntu1
    • 2.39.1-0ubuntu2
    • 2.39.1-0ubuntu3
    • 2.39.2-0ubuntu1
    • 2.39.2-0ubuntu2
    • 2.39.3-0ubuntu4
    • 2.39.4-0ubuntu1
    • 2.39.90-0ubuntu1
    • 2.39.91-0ubuntu2
    • 2.39.91-0ubuntu3
    • 2.39.92-2
    • 2.40.0-1
    • 2.40.0-1ubuntu1
    • 2.40.0-2
    • 2.40.2-0ubuntu1
    • 2.40.2-0ubuntu1.1
    • 2.40.2-0ubuntu1.1+esm1
    • 2.40.2-0ubuntu1.1+esm2
    • 2.40.2-0ubuntu1.1+esm3
    • 2.40.2-0ubuntu1.1+esm4
    • 2.40.2-0ubuntu1.1+esm6
    • 2.40.2-0ubuntu1.1+esm7
    • 2.40.2-0ubuntu1.1+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.46.1-1
    • 2.46.1-2
    • 2.47.1-1
    • 2.47.3-3
    • 2.47.4-1
    • 2.47.5-1
    • 2.47.6-1
    • 2.48.0-1ubuntu3
    • 2.48.0-1ubuntu4
    • 2.48.1-1~ubuntu16.04.1
    • 2.48.2-0ubuntu1
    • 2.48.2-0ubuntu3
    • 2.48.2-0ubuntu4
    • 2.48.2-0ubuntu4.1
    • 2.48.2-0ubuntu4.2
    • 2.48.2-0ubuntu4.3
    • 2.48.2-0ubuntu4.4
    • 2.48.2-0ubuntu4.5
    • 2.48.2-0ubuntu4.6
    • 2.48.2-0ubuntu4.7
    • 2.48.2-0ubuntu4.8
    • 2.48.2-0ubuntu4.8+esm1
    • 2.48.2-0ubuntu4.8+esm3
    • 2.48.2-0ubuntu4.8+esm4
    • 2.48.2-0ubuntu4.8+esm5
    • 2.48.2-0ubuntu4.8+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.54.1-1ubuntu1
    • 2.55.2-2ubuntu1
    • 2.56.0-2ubuntu1
    • 2.56.0-4ubuntu1
    • 2.56.1-2ubuntu1
    • 2.56.2-0ubuntu0.18.04.1
    • 2.56.2-0ubuntu0.18.04.2
    • 2.56.3-0ubuntu0.18.04.1
    • 2.56.4-0ubuntu0.18.04.2
    • 2.56.4-0ubuntu0.18.04.3
    • 2.56.4-0ubuntu0.18.04.4
    • 2.56.4-0ubuntu0.18.04.5
    • 2.56.4-0ubuntu0.18.04.6
    • 2.56.4-0ubuntu0.18.04.7
    • 2.56.4-0ubuntu0.18.04.8
    • 2.56.4-0ubuntu0.18.04.9
    • 2.56.4-0ubuntu0.18.04.9+esm3
    • 2.56.4-0ubuntu0.18.04.9+esm4
    • 2.56.4-0ubuntu0.18.04.9+esm5
    • 2.56.4-0ubuntu0.18.04.9+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.62.1-1
    • 2.63.1-2
    • 2.63.1-2ubuntu1
    • 2.63.3-1
    • 2.63.3-3
    • 2.63.5-2
    • 2.64.0-1
    • 2.64.1-1
    • 2.64.2-1~fakesync1
    • 2.64.3-1~ubuntu20.04.1
    • 2.64.6-1~ubuntu20.04.1
    • 2.64.6-1~ubuntu20.04.2
    • 2.64.6-1~ubuntu20.04.3
    • 2.64.6-1~ubuntu20.04.4
    • 2.64.6-1~ubuntu20.04.6
    • 2.64.6-1~ubuntu20.04.7
    • 2.64.6-1~ubuntu20.04.8
    • 2.64.6-1~ubuntu20.04.9
    • 2.64.6-1~ubuntu20.04.9+esm1
    • 2.64.6-1~ubuntu20.04.9+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:22.04:LTS

    Versions
    • 2.68.4-1ubuntu1
    • 2.70.1-1
    • 2.70.2-1
    • 2.71.0-2
    • 2.71.1-1
    • 2.71.2-1
    • 2.71.3-1
    • 2.72.0-1
    • 2.72.1-1
    • 2.72.4-0ubuntu1
    • 2.72.4-0ubuntu2
    • 2.72.4-0ubuntu2.2
    • 2.72.4-0ubuntu2.3
    • 2.72.4-0ubuntu2.4
    • 2.72.4-0ubuntu2.5
    • 2.72.4-0ubuntu2.6
    • 2.72.4-0ubuntu2.7
    • 2.72.4-0ubuntu2.8
    • 2.72.4-0ubuntu2.9
    • 2.72.4-0ubuntu2.10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:24.04:LTS

    Versions
    • 2.78.0-2
    • 2.78.1-4
    • 2.78.3-1
    • 2.78.3-2
    • 2.79.1-1
    • 2.79.2-1~ubuntu1
    • 2.79.3-3ubuntu5
    • 2.80.0-6ubuntu1
    • 2.80.0-6ubuntu3
    • 2.80.0-6ubuntu3.1
    • 2.80.0-6ubuntu3.2
    • 2.80.0-6ubuntu3.4
    • 2.80.0-6ubuntu3.5
    • 2.80.0-6ubuntu3.6
    • 2.80.0-6ubuntu3.7
    • 2.80.0-6ubuntu3.8
    • 2.80.0-6ubuntu3.9
    • 2.80.0-6ubuntu3.10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:26.10

    Versions
    • 2.88.0-1
    • 2.88.1-2
    • 2.89.2-1
    • 2.89.3-3
    • 2.89.3-4
    • 2.90.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • glib2.0 Ubuntu:26.04:LTS

    Versions
    • 2.86.0-2
    • 2.86.1-1
    • 2.86.1-2
    • 2.86.2-1
    • 2.86.3-1
    • 2.86.3-4
    • 2.87.2-2
    • 2.87.2-3
    • 2.87.3-1
    • 2.88.0-1
    • 2.88.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →