CVE-2026-5958

OVERVIEW CVE-2026-5958 is a race condition vulnerability in GNU sed that occurs when the utility is invoked with both the -i (in-place edit) and --follow-symlinks options enabled. The flaw stems from a non-atomic sequence of operations where sed resolves a symlink to its target, then separately opens the original symlink path. An attacker exploiting this race condition can atomically replace the symlink with a different target between these operations, causing sed to read content from an attacker-controlled source while writing the processed output to an unintended location. The vulnerability affects sed versions prior to 4.10. SEVERITY The attack requires local access and precise timing to exploit the race window between the two filesystem operations, making it moderately complex to execute reliably. The attack vector is local only, and the attacker must have the ability to manipulate symlinks on the target system. The potential impact is significant: an attacker can overwrite arbitrary files with attacker-controlled content in the context of the sed process, potentially achieving privilege escalation or system compromise depending on file permissions and sed's execution context. EXPLOITATION STATUS There is no indication of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. No public exploit code has been reported or widely distributed. Community attention appears minimal, reflected in the low EPSS score of 0.000040 and FAUCET risk score of 24.0 out of 100. Users running sed version 4.10 or later are protected from this vulnerability.