ZeroDay Findings
Sign inSign up

Findings

CVE-2026-4878

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Published Apr 9, 2026 · updated Oct 14, 2026 · Red Hat Red Hat Enterprise Linux 10

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 9, 2026 · Catalog

    Detected

    A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

  2. Oct 14, 2026 · Catalog

    Updated

    A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Affected

  • vendor Red Hat Red Hat Enterprise Linux 10version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-Onversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsversion unspecified

Sources

  • CIRCL Vulnerability LookupCVE-2026-4878

    A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing s

    vulnerability.circl.lu

References

CVE-2026-4878 · ZeroDay Findings