LACT CVE-2026-75038

Exploitation requires local interactive access to a system where LACT is installed, with at minimum low-privilege shell access (confirmed by PR:L in the CVSS 4.0 vector). The attacker must additionally have write access to the parent directory of a file path that LACT's privileged process accesses, in order to substitute a symlink before the operation executes. Remote exploitation is not possible given the local attack vector (AV:L). No network connectivity, user interaction, or special service configuration is required once local shell access is established. Exploitation is inherently limited to multi-user systems where untrusted local accounts coexist with LACT installations - single-user workstations or systems with tightly controlled local access are not meaningfully exposed.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H) scores 6.9, reflecting genuine local availability impact at low complexity and low privilege, though the local-only attack vector substantially limits real-world exposure. No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at the time of analysis. POC availability is unknown. Notably, the 'Information Disclosure' tag in the source metadata conflicts with the CVE description, which specifies only denial-of-service - this discrepancy should be verified against the SUSE Bugzilla entry before treating confidentiality impact as confirmed. In practice, even a mid-sized municipal IT team in tczew running shared Linux workstations with AMD GPU tooling would face a very narrow blast radius, since exploitation requires an interactive local account on a machine where LACT is actively installed - an uncommon enterprise posture. Overall risk is low outside of shared multi-user Linux desktop or workstation environments where untrusted local users exist.

A local low-privileged user identifies a file path that LACT's privileged process is scheduled to write to, then replaces that path with a symbolic link pointing to a sensitive system file or LACT's own runtime resource. When LACT executes its file operation, it follows the symlink to the attacker-chosen target, causing that resource to be corrupted, truncated, or locked - producing a denial-of-service condition. No public exploit code is known at the time of analysis.