Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-41259

SWUpdate Untrusted Script Execution via Signed Update TOCTOU

Description

SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sbabic SWUpdate

Default version status: unaffected

  • 0 to < 2026.05affected

References