CVE-2026-25704

CVE-2026-25704 is a Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability found in cosmic-greeter, affecting versions before pull request #426. This flaw allows a local attacker to regain and abuse privileges that should have been dropped due to racy checking logic. Rated 5.8 Medium (CVSSv4), exploitation requires local access and low privileges, but has high attack complexity, potentially leading to high impact on system availability and low impact on confidentiality and integrity. There is currently no evidence of active exploitation, nor are public exploit codes available, and community discussion or media coverage for this CVE is absent.