CVE-2025-71176 is a vulnerability in pytest packaged by Red Hat that involves insecure handling of temporary directories, specifically the use of predictable directory names under /tmp/pytest-of-{user}. This flaw allows a local attacker to cause denial of service or potentially escalate privileges by manipulating these temporary directories. The vulnerability is classified under CWE-379 (Creation of Temporary File in Directory with Insecure Permissions). Red Hat rates this issue as moderate severity and notes that mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. The vulnerability affects local users executing pytest on affected Red Hat products.

Local users can exploit this vulnerability to cause denial of service or potentially gain elevated privileges on affected systems. The impact is limited to systems where pytest is installed and executed locally. Confidentiality, integrity, and availability impacts are rated low to moderate by Red Hat, with the primary risk being denial of service or privilege escalation via insecure temporary directory handling.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for this vulnerability. Users should monitor Red Hat advisories for future updates. Until a fix is available, limiting local user access and avoiding running pytest in untrusted environments may reduce risk. Customers with a Technical Account Manager (TAM) can consult directly for guidance. No immediate patch is available as per the vendor advisory.