File-change notification features in major operating systems allow applications to receive alerts when files are created, modified, or deleted. Researchers at Graz University of Technology showed that these features can be abused by unprivileged users or apps to monitor other users on the same system. The attacks do not expose file contents but use file names and event timing to infer sensitive user activities such as keystroke timing (revealing typing rhythms), visited websites via browser data folders, and media events in apps like WhatsApp. On Linux, watching readable folders can leak events from protected files. On Windows, monitoring the root of the system drive reveals full paths of changed files across user profiles. The Linux kernel has been partially hardened (CVE-2025-68788) to reduce severity, but no fixes exist for Android or macOS. Microsoft states this behavior is by design and recommends standard security best practices. Researchers have not observed active exploitation in the wild but have published proof-of-concept code.

The vulnerability allows an attacker with local code execution under a separate user account to monitor file system events and infer user activities such as keystroke timing, browsing history, and media file events without accessing file contents. This can lead to privacy breaches and credential harvesting via UI spoofing (demonstrated on KDE Plasma 6). The impact is limited to information disclosure of metadata and timing, not direct file content access. No remote exploitation or privilege escalation is indicated. The attack requires local presence and code execution under a different user context.

Linux kernel has a partial fix (CVE-2025-68788) that disables device file event generation, mitigating the most severe issues. Microsoft considers the Windows behavior by design and recommends limiting local access to trusted users and keeping systems updated. Administrators can enable protections documented by Microsoft for certain directory change notification scenarios. No patches or mitigations are currently available for Android or macOS. Users should follow vendor guidance and restrict untrusted local code execution. No urgent patching is mandated as the issue requires local attacker presence and does not expose file contents.