This vulnerability (CVE-2026-41051) affects the csync2 component in SUSE openSUSE Tumbleweed. The issue arises from the use of insecure temporary directories when compiled with C99 or later, which allows TOCTOU race condition attacks (CWE-367). The CVSS 4.0 base score is 5.1, reflecting a moderate severity with local attack vector, low attack complexity, and requiring low privileges with user interaction. No patch or official remediation guidance has been provided by the vendor at this time, and no known exploits exist in the wild. The affected versions are not specified.

The vulnerability could allow an attacker with local access and low privileges to exploit a TOCTOU race condition in csync2 by targeting insecure temporary directories. This may lead to potential unauthorized actions or data manipulation during the time window between checking and using these directories. However, no known exploits have been reported, and the overall risk is assessed as medium severity.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the SUSE vendor advisories for updates and apply any future patches promptly once released. Until then, limiting local access to trusted users and avoiding use of vulnerable csync2 builds compiled with C99 or later may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.