Cosmic Greeter EUVD-2026-17067

Cosmic-greeter is the graphical login/authentication manager for Pop!_OS systems. The vulnerability stems from a time-of-check time-of-use (TOCTOU) race condition in privilege management logic-the application checks whether privileges should be dropped at one point in execution, but a race window exists before those privileges are actually lowered, allowing an attacker to exploit the temporal gap. CWE-271 encompasses improper privilege dropping or lowering, where the application fails to ensure that elevated permissions are consistently maintained at the required level throughout execution. The affected CPE indicates all versions of cosmic-greeter prior to the patch commit are vulnerable.