CVE-2026-44469

HighCVSS 7.8

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition to replace verified files with malicious ones before installation, resulting in local privilege escalation.

Risk Assessment

An attacker can gain elevated privileges by installing malicious files during the installation process, potentially leading to full system compromise.

Recommendation

Apply the vendor patch that fixes the TOCTOU race condition and corrects temporary directory permissions.

Other vulnerabilities in Unknown product

CVE-2024-6423Medium
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging, potentially exposing confidential information.

Original NVD description (English source)

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS