CVE-2026-4878

MediumCVSS 6.7

Published: 09/04/2026(UTC)Updated: 02/10/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

A flaw was found in libcap. A local unprivileged user can exploit a TOCTOU race condition in the `cap_set_file()` function, allowing an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file.

Risk Assessment

An attacker can inject or strip capabilities from unintended executables, leading to privilege escalation on the system.

Recommendation

Update libcap to the latest version containing the fix for the race condition.

Other vulnerabilities in libcap

CVE-2025-1390Medium
The PAM module pam_cap.so of libcap supports group names starting with “@”, but during parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security issues.

Original NVD description (English source)

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS