Read the docs
TI-2025-19444 Aliases CVE-2025-26499GHSA-fh9m-7jq4-376w

Under heavy system utilization a random race condition can occur during authentication or…

Priority LOW 26CWE-270Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user’s system rights and data access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00138 3rd percentileScored 2026-11-07
Fix Fixed Wind River Studio Developer (Wind River Studio Developer): 24.11>=

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Wind River Studio DeveloperWind River Studio Developer24.11 to before 24.11>=24.11>=Patch availableCNA

Remediation

  • Fix · CNA Wind River Studio Developer (Wind River Studio Developer) Fixed in 24.11>=

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-26499
  2. 2026-10-03 Alias added: GHSA-fh9m-7jq4-376w

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences