MaxKB CVE-2025-66446

Requires an authenticated low-privileged MaxKB account (PR:L) plus successfully winning a race condition (AC:H, CWE-362) against improperly-permissioned critical files - specifically the built-in dynamic linker (ld.so) and other system files that MaxKB leaves writable. Exploitation is limited to MaxKB versions 2.3.1 and below; version 2.4.0 remediates it. Limiting factors: the attacker must already hold valid low-privilege access, must reliably hit the narrow race-timing window, and a higher-privileged process must subsequently load the overwritten file for escalation to occur. No user interaction is required (UI:N).

Signals point to a moderate, not urgent, priority despite the 7.5 'High' CVSS. The NVD vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) requires an already-authenticated low-privileged account (PR:L) and a high-complexity race-condition window (AC:H, consistent with the CWE-362 classification), which meaningfully constrains real-world exploitation. EPSS reinforces this: 0.35% probability at the 26th percentile indicates low near-term mass-exploitation expectation. There is no CISA KEV listing and no public proof-of-concept in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. One tension to verify: the vector is AV:N, but overwriting the on-disk dynamic linker and critical files is inherently a local filesystem action, so network reachability likely depends on authenticated MaxKB application features being abused - verify the true attack surface with the vendor advisory (GHSA-5xx2-3q9w-jpgf). Also note a scope judgment call: NVD rates S:U, yet escalation from the application context to the host/root arguably crosses a trust boundary (S:C); this is debatable and does not change the overall moderate rating. Net: patch on a normal prioritized cycle, not as an emergency.

A low-privileged authenticated MaxKB user abuses improper file permissions to target the built-in dynamic linker or other critical files, winning a race condition (CWE-362) to overwrite one with attacker-controlled content. When a higher-privileged process subsequently loads the tampered file, the attacker's code executes with elevated (potentially root) privileges. No public exploit was identified at time of analysis, and the high attack complexity (AC:H) reflects the timing precision needed to win the race.