CVE-2026-4878

CVE-2026-4878 is a time-of-check-to-time-of-use (TOCTOU) race condition vulnerability in libcap's cap_set_file() function that enables local privilege escalation. An unprivileged attacker with write access to a parent directory can exploit this flaw to redirect capability updates to attacker-controlled files, potentially injecting or stripping capabilities from unintended executables. The vulnerability has a CVSS score of 6.7 (Medium) with a local attack vector and high complexity. Successful exploitation requires low privileges and user interaction, but impacts all three security attributes—confidentiality, integrity, and availability—through capability manipulation leading to privilege escalation. The attack surface is limited to systems where the attacker already has filesystem write permissions. This vulnerability currently shows no signs of active exploitation in the wild. It is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hotlists. The extremely low EPSS score of 0.00004 indicates minimal practical exploitation likelihood relative to the broader CVE landscape, suggesting it remains primarily a theoretical risk at this time.