CVE-2026-86469 Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path
A local attacker can exploit a race condition in GLib2 to redirect file writes, potentially modifying arbitrary files or escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86469?
CVE-2026-86469 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 7 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.
Weakness: CWE-59
Which versions are affected by CVE-2026-86469?
How do I fix CVE-2026-86469?
No fix has been published for CVE-2026-86469 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86469 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86469 exists.
Sources
Also known as AZL-99993, DEBIAN-CVE-2026-86469, ECHO-aa8f-2737-8436, GHSA-847x-vxjh-whpv, UBUNTU-CVE-2026-86469.