Search: CVE-2026-76925

CVE-2026-76925 is a medium severity vulnerability in Flatpak on Red Hat Enterprise Linux 10 involving a Time-of-check to time-of-use (TOCTOU) race condition. The flaw exists in the org.freedesktop.Flatpak.SystemHelper component where a privileged chmod operation occurs before OSTree repository validation in the Deploy() function. This timing window allows an attacker to redirect symlinks to arbitrary files, potentially enabling unauthorized file manipulation or information disclosure.