A flaw in GLib2's g_file_replace() function when used with G_FILE_CREATE_REPLACE_DESTINATION can lead to a race condition if the temporary file creation fails. In this fallback path, the destination file is unlinked and recreated without exclusive creation or symlink protection, enabling a local attacker with write access to the destination directory to redirect writes to another file. This improper link resolution before file access (CWE-59) can allow overwriting or creating files the victim process is permitted to write, potentially impacting integrity and availability. Exploitation requires local access, write permissions on the directory, and winning a race condition. The usual g_file_replace() path that writes to a temp file first is not vulnerable. Red Hat has published an advisory but has not confirmed an official patch or remediation level yet.

The vulnerability allows a local attacker with write access to the destination directory to exploit a race condition and redirect file writes to unintended files. This can lead to modification or creation of files that the victim process is allowed to write, impacting data integrity and potentially availability. Confidentiality is not affected. The attack complexity is high, requiring a race condition to be won, and privileges required are low. There is no indication of remote exploitation or user interaction needed.

Red Hat advises not to use g_file_replace() with the G_FILE_CREATE_REPLACE_DESTINATION flag on paths located in directories writable by less-privileged users. This mitigates the risk by preventing attackers from controlling the directory where the race condition can be exploited. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-86469 for updates on fixes or official remediation guidance.