Skip to content
Fencer Vulns
low 2.1

CVE-2026-5958 json

Race Condition in GNU Sed

published 2026-04-20 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-23834 , GHSA-9r7w-j29g-xqx8 , JLSEC-2026-213

cvss
2.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.

This issue was fixed in version 4.10.

Patch / fix

  • julia sed_jll 4.10.0+0
  • GNU Sed 4.10
  • sed Debian 12 4.9-1+deb12u1
  • sed Debian 13 4.9-2+deb13u1
  • sed Debian 14 4.9-3

debian advisories DEBIAN-CVE-2026-5958

  • sed Ubuntu 22.04 LTS 4.8-1ubuntu2.1
  • sed Ubuntu 24.04 LTS 4.9-2ubuntu0.24.04.1
  • sed Ubuntu 25.10 4.9-2ubuntu0.25.10.1
  • sed Ubuntu 26.04 LTS 4.9-2ubuntu1
  • sed Ubuntu Pro 18.04 LTS 4.4-2ubuntu0.1~esm1
  • sed Ubuntu Pro 20.04 LTS 4.7-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-5958

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • sed hummingbird 1 4.10-1.hum1

red hat advisories RHSA-2026:10995

  • sed SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.9-160000.3.1

suse advisories SUSE-SU-2026:22256-1SUSE-SU-2026:22325-1

  • sed openSUSE Leap 16.0 4.9-160000.3.1
  • sed openSUSE Tumbleweed 4.10-1.1

opensuse advisories openSUSE-SU-2026:21024-1openSUSE-SU-2026:10649-1

  • sed Azure Linux 3.0 4.9-2

azure linux advisories AZL-83102

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5958 updated cvss 6.3

sed: GNU sed TOCTOU race condition

  • Red Hat Enterprise Linux 6 sed Red Hat Enterprise Linux 7 sed Red Hat Enterprise Linux 8 sed Red Hat Enterprise Linux 9 sed Red Hat Enterprise Linux 10 sed Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-automl-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-mlflow-rhel9, +6 more
    under investigation
  • Red Hat Hardened Images sed 4.10-1.hum1
    fixed: vendor fix RHSA-2026:10995
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-kube-rbac-proxy-rhel9, rhoai/odh-maas-controller-rhel9, rhoai/odh-mlflow-operator-rhel9, rhoai/odh-model-controller-rhel9, rhoai/odh-ogx-k8s-operator-rhel9, +14 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
julia sed_jll
<4.10.0+0
4.10.0+0

Affected products

  • GNU Sed

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.