CVE-2026-62294 describes a time-of-check to time-of-use (TOCTOU) race condition in flameshot screenshot software before version 14.0.0. The Open With feature writes screenshots to a predictable temporary path and follows symbolic links without proper synchronization, enabling a local attacker to exploit this race condition by pre-creating a symlink. This can lead to arbitrary file overwrites of any file the victim user has write access to. The vulnerability is categorized under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-377 (Insecure Temporary File).

A local unprivileged attacker on the same machine can exploit this race condition to overwrite arbitrary files that the victim user can write, potentially leading to data corruption or privilege escalation depending on the victim user's permissions. The CVSS 4.0 score is 5.1 (medium severity), reflecting the local attack vector and required conditions.

This vulnerability is fixed in flameshot version 14.0.0. Users should upgrade to version 14.0.0 or later to remediate this issue. No other official remediation or temporary fix information is provided. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 14.0.0, indicating an official fix is available.