Glib2.0: A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary… (CVE-2026-86469)

CVE-2026-86469 describes a flaw in GLib2 where the g_file_replace() function, when invoked with the G_FILE_CREATE_REPLACE_DESTINATION flag, mishandles failure in creating the temporary .goutputstream-XXXXXX file. Specifically, the library unlinks the destination file and recreates it without safeguards such as exclusive creation or symlink protection. This creates a race condition that a local attacker with write permissions to the destination directory can exploit to redirect file writes to arbitrary files.

The vulnerability allows a local attacker with write access to the destination directory to exploit a race condition to redirect file writes to other files. This can lead to unauthorized file modification or corruption. The CVSS score is 5.3 (medium severity), indicating limited impact confined to local privilege scenarios with high attack complexity and requiring low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local write permissions to directories where g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to trusted users only to reduce the risk of exploitation.