GLib2 EUVD-2026-72488

Exploitation requires four concurrent conditions: (1) the attacker holds local write permission to the directory containing the target file (PR:L); (2) a process - ideally one running with privileges the attacker does not hold - calls g_file_replace() on that file using the G_FILE_CREATE_REPLACE_DESTINATION flag; (3) the temporary file creation step (.goutputstream-XXXXXX) fails, triggering the unprotected fallback code path - this is an error condition, not the normal path; and (4) the attacker successfully wins the TOCTOU race between the destination unlink and the subsequent recreate without O_EXCL. Exploitation is further limited by fs.protected_symlinks=1 (default-on in RHEL 7+), which blocks symlink following when the symlink owner differs from the following process. Remote exploitation is not applicable (AV:L).

Real-world risk is constrained by multiple compounding prerequisites: the attacker must be a local user with write permission to the target directory, the failure path in g_file_replace() must be triggered, and the attacker must win a tight timing race. The CVSS AC:H rating correctly reflects this. EPSS data is not provided, and no KEV or public POC has been identified, so there is no signal of active exploitation. The integrity impact (I:H) is meaningful where a privileged process - such as a system service, package manager, or container runtime - uses g_file_replace() with this flag; if an attacker can redirect such a write to /etc/passwd or a setuid binary, privilege escalation is plausible. However, the triggering condition (temp file creation failure) is an error path, making reliable exploitation harder in practice. The 'Information Disclosure' tag in the input metadata conflicts with the CVSS C:N rating and the description - this is an integrity/file-write attack, not a disclosure issue. Red Hat's CPE scope covers RHEL 6 through 10, Hardened Images, and OpenShift Container Platform 4, indicating broad Red Hat ecosystem exposure. Absent exploitation signal, this ranks as a medium-priority hardening fix rather than an emergency patch.

A local attacker on a shared system identifies that a privileged daemon (e.g., a system configuration manager or package tool) calls g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION on a file inside a world-writable or group-writable directory. The attacker triggers or waits for the error condition that causes temp file creation to fail, then races to replace the destination path with a symlink pointing to /etc/cron.d/attacker. If the race is won, the daemon writes its output - potentially attacker-influenced configuration - to the cron directory, achieving privilege escalation.