Cosmic Greeter EUVD-2026-17067

Without CVSS vector or EPSS data, formal risk quantification is limited, but the vulnerability's nature presents moderate-to-high real-world risk: privilege escalation via race condition typically requires local access and precise timing but is reliably exploitable on multi-core systems where race windows are reproducible. No KEV status or public POC availability is indicated in the provided intelligence. The TOCTOU class (CWE-271) is well-understood and frequently exploitable in authentication/login contexts. Since cosmic-greeter runs at login time with elevated privileges, successful exploitation could allow a local attacker to bypass intended privilege restrictions, potentially gaining root access. The vulnerability is not a false-positive high-CVSS issue; local privilege escalation in a login manager is a genuine security concern, though impact depends on the specific privileges being dropped and the attacker's initial access level.

A local, unprivileged user logs into a system running vulnerable cosmic-greeter. During the login process, as the greeter attempts to drop elevated privileges after authentication validation, the attacker exploits the TOCTOU window by issuing system calls or manipulating process state to prevent the privilege drop or regain access to elevated file descriptors/capabilities. This could allow the attacker to execute commands or access resources with root privileges that should have been restricted to the greeter process only, resulting in local privilege escalation.