CVE-2026-4878
Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
Published Apr 9, 2026 · updated Oct 14, 2026 · libcap project libcap
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Timeline
Detection, updates, and resolution for this record.
Apr 9, 2026 · Catalog
Detected
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Oct 14, 2026 · Catalog
Updated
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
Affected
- cpe libcap project/libcapversion unspecified
- cpe redhat/enterprise linux10.0
- cpe redhat/enterprise linux8.0
- cpe redhat/enterprise linux9.0
- cpe redhat/openshift container platform4.0
- vendor Red Hat Red Hat Enterprise Linux 10version unspecified
- vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Supportversion unspecified
- vendor Red Hat Red Hat Enterprise Linux 8version unspecified
- vendor Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportversion unspecified
- vendor Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onversion unspecified
- vendor Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceversion unspecified
- vendor Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-4878
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing s
vulnerability.circl.lu - CVE.orgCVE-2026-4878
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-4878
30-day exploitation probability 0.1%
first.org - NIST NVDCVE-2026-4878
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled
nvd.nist.gov