CVE-2025-41259

Description

SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.

PUBLISHED Reserved 2025-04-16 | Published 2026-06-03 | Updated 2026-06-03 | Assigner sba-research

Problem types

CWE-367 Time-of-check time-of-use (TOCTOU) race condition

Product status

Credits

Reinhard Kugler (SBA Research) finder

References

github.com/...sted_Script_Execution_via_Signed_Update_TOCTOU exploit

github.com/...sted_Script_Execution_via_Signed_Update_TOCTOU third-party-advisory

github.com/...ommit/f4bd64260e233e207354d68d572b1cbc3e63689d patch

github.com/sbabic/swupdate product

cve.org (CVE-2025-41259)

nvd.nist.gov (CVE-2025-41259)

Download JSON