# CVE-2026-76925

## Summary

- **CVE ID:** CVE-2026-76925
- **Severity:** MEDIUM
- **CVSS Score:** 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L)
- **CWE:** CWE-367
- **Published:** Sep 4, 2026
- **Last Modified:** Sep 8, 2026

## Description

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

## Affected Products

No affected products listed.

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-76925)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2520099)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.10%
- **EPSS Percentile:** 0.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._