CVE-2026-46607 describes a deserialization of untrusted data vulnerability in nicolargo Glances before version 4.5.5. The vulnerability occurs in the glances/outdated.py component, which uses Python's pickle.load() to read a version-check cache file located at ~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db. Because the file is stored at a predictable, world-accessible path and no validation or signature verification is performed before deserialization, an attacker with write access to this file can craft a malicious pickle payload. This can lead to arbitrary code execution with the privileges of the user running Glances when it starts with version checking enabled (enabled by default). The vulnerability has a CVSS 3.1 base score of 7.8 (high severity). The issue is resolved in Glances version 4.5.5.

Successful exploitation allows an attacker with write access to the cache file path to execute arbitrary code as the OS user running Glances. This can lead to full compromise of the user's environment and potentially further system impact depending on user privileges. The vulnerability affects confidentiality, integrity, and availability (all rated high).

A fix is available in Glances version 4.5.5. Users should upgrade to version 4.5.5 or later to remediate this vulnerability. Until upgrading, restricting write access to the cache file path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db) to trusted users only can reduce risk. No vendor advisory content is provided, so patch status is based on the stated fixed version.