Threats tagged 'brew-hf-cve-2026-112939'

A vulnerability in the filelock library versions 3.22.0 through 4.2.0 allows a local user with write access to a lock marker file to forge the process ID (PID) recorded in the marker. This causes another process, running as the lock owner or root, to mistakenly consider the lock stale and remove the live marker, resulting in multiple processes concurrently holding the lock. The issue arises when the marker file is created or modified with group or other write permissions, typically due to an explicit mode or a permissive umask in a sticky or non-removable directory. The vulnerability has a CVSS score of 4.7 (Medium) and impacts integrity but not confidentiality or availability.