The vulnerability occurs in GNU Sed when invoked with both the -i (in-place edit) and --follow-symlinks options. The function open_next_file() first resolves the symlink to its target and stores that path, then opens the original symlink path to read the file. Because these two filesystem operations are separate and non-atomic, an attacker can replace the symlink target in the race window between these calls. This leads sed to read from the new attacker-controlled target but write output to the originally resolved path, enabling arbitrary file overwrite. The flaw is classified as CWE-367 (Time-of-check Time-of-use race condition) and was addressed in version 4.10 of GNU Sed.

An attacker with the ability to atomically replace symlinks during sed's operation can cause arbitrary file overwrite with content controlled by the attacker. This could lead to unauthorized modification of files in the context of the sed process. The CVSS 4.0 score is 2.1 (low severity), reflecting the local attack vector and limited impact scope. There are no known exploits in the wild.

This vulnerability is fixed in GNU Sed version 4.10. Users should upgrade to version 4.10 or later to remediate this issue. No official patch or temporary fix is indicated in the advisory data. Until upgrading, avoid using sed with both -i and --follow-symlinks options on untrusted symlinks to reduce risk. Patch status is not explicitly confirmed beyond the fixed version; check the vendor advisory for the latest remediation guidance.