Flatpak EUVD-2026-85424

Requires an active local session as an unprivileged user on a host running Flatpak before 1.18.1 with the flatpak-system-helper (system-wide/root installation path) in use. The attacker must be able to open two concurrent revokefs writer sessions and win a TOCTOU race: create a symlink in one session directory pointing into the other's directory and retain a file descriptor through it, then modify the target session's files after the system helper has validated and imported them (specifically ostree commit objects after signature verification). Limiting factors: no remote vector (local access mandatory), high attack complexity due to the required race window and dual-session setup, and it only applies to system-helper-mediated repository imports; single-user/user-mode installs without the privileged helper are not the target path.

This is a genuine local privilege escalation to root in a widely-deployed Linux component, but it is not a drop-everything emergency. The vendor CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 7.4) is internally consistent with the description: exploitation is strictly local (AV:L, requires an active local session), of high complexity (AC:H) because it depends on a TOCTOU race between two concurrently-held revokefs sessions plus fd retention through a symlink, and yields full compromise (C:H/I:H/A:H) because the end state is arbitrary root-controlled file writes. Note PR:N despite local scope - no elevated privileges are needed beyond a normal local session, so an unprivileged desktop user qualifies. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' The AC:H race requirement and local-only vector meaningfully cap real-world exploitation versus a remote unauth bug of the same score. One nuance: S:U is defensible but arguably understated, since crossing from an unprivileged user to root arguably represents a security-scope change (S:C would raise the score); treat 7.4 as a reasonable floor.

An unprivileged but locally logged-in user opens two revokefs sessions through the flatpak-system-helper, plants a symlink inside one session that points into the other session's directory, and holds a file descriptor open through that symlink. After the system helper validates and imports data (including signature-verified ostree commit objects) into the second session, the attacker uses the retained fd to overwrite those objects, causing the root-privileged helper to write attacker-chosen content to attacker-chosen paths and escalating to root. No public POC is referenced, and the AC:H TOCTOU race makes reliable exploitation non-trivial.