Glib2.0: A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary… (CVE-2026-86469)

The GLib2 library contains a flaw in the g_file_replace() function when invoked with the G_FILE_CREATE_REPLACE_DESTINATION flag. If the creation of the temporary file .goutputstream-XXXXXX fails, the library unlinks the target destination file and recreates it without using exclusive creation or symlink protection. This creates a time-of-check to time-of-use (TOCTOU) race condition (CWE-59) where a local attacker with write permissions to the destination directory can replace the intended file with a symlink or another file, causing the victim process to write to an unintended location. The usual g_file_replace() path that writes to a temporary file first is not vulnerable; only the fallback path is affected. Exploitation is local, requires write access to the directory, and a successful race to redirect writes. The vulnerability impacts integrity and availability but not confidentiality.

A local attacker with write access to the destination directory can exploit a race condition to redirect file writes to arbitrary files, potentially overwriting or creating files that the victim process is allowed to write. This can lead to integrity violations and partial denial of service. Confidentiality is not impacted. The attack complexity is high and requires low privileges but no user interaction. There are no known exploits in the wild.

Do not use g_file_replace() with the G_FILE_CREATE_REPLACE_DESTINATION flag on paths located in directories writable by less-privileged users. Avoid scenarios where the fallback temporary file creation fails. No official patch or fix is currently confirmed; check vendor advisories for updates. The vulnerability requires local write access and a race condition, so restricting directory write permissions is an effective mitigation.