CVE-2026-4878
🔶 mediumSummary
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
CVSS Score
6.7
Medium
EPSS Score
0.0
Published Date
2026-04-09
First Seen: 2026-04-10
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 48.9% of all 318,071 vulnerabilities in our database.
#162,571
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Apr 9, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Red Hat would like to thank Ali Raza for reporting this issue.
SSVC data provided by
CISA
Last Modified
2026-04-28
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)