csync2 CVE-2026-41051

csync2 must be compiled with C99 or later C standard (not earlier C89/C90 implementations). The attacker must have local user-level access to the system (PR:L in CVSS). User interaction is required, meaning csync2 must be actively invoked or scheduled to perform synchronization (UI:R) - the vulnerability does not trigger automatically on daemon startup. The attacker must know or predict the temporary directory path used by csync2 and be able to manipulate the filesystem in that location (typically /tmp or a csync2-specific temp directory). Non-affected conditions: systems running csync2 compiled with C89/C90 standards are not vulnerable; systems where csync2 is not actively executed, or systems where /tmp and similar directories are protected against symlink attacks (e.g., via mount options), significantly reduce exploitability.

CVSS 5.0 with local attack vector (AV:L) and low complexity (AC:L) indicates a local-only vulnerability requiring legitimate system access. The CVSS vector shows low privilege requirements (PR:L) and requires user interaction (UI:R), which significantly limits real-world exploitation scope - an attacker must be a local user and trigger specific application behavior. The confidentiality and integrity impact are none (C:N/I:N), with only availability impact (A:H), meaning the primary risk is denial of service through application crashes or malfunction rather than data breach. EPSS data is not provided, making probability estimation uncertain. No KEV status or public exploit confirmation is provided, suggesting this is not actively exploited at scale. The attack surface is restricted to systems where csync2 is locally installed and actively used; this is not a network-reachable vulnerability. The real-world risk is moderate for administrators managing csync2 deployments on shared systems where untrusted local users exist, but low for isolated deployments or single-user systems.

A local user on a system running csync2 monitors the default temporary directory location and creates a symlink pointing to a critical application file just before csync2 attempts to create its temporary directory during a sync operation. When csync2 writes to what it believes is its temporary directory but is actually the symlink target, the critical application file is overwritten or truncated, causing denial of service. Alternatively, the attacker creates the temporary directory with restrictive permissions between the time csync2 checks for its existence and attempts to use it, causing csync2 to fail with permission errors.