CVE-2025-41259: SWUpdate Untrusted Script Execution via Signed Update TOCTOU
Published Jun 3, 2026
·Updated
SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.
Affected Software
1 affected component
SWUpdate Swupdate<2026.05
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SWUpdateto a version that resolves this vulnerability.Fixed in 2026.05
Event History
Jun 3, 2026
CVE Published
via MITRE·11:01 AM
Data Sourced
via MITRE·11:01 AM
DescriptionWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-41259?
CVE-2025-41259 has a high severity rating of 7.3 according to CVSS.
2
How do I fix CVE-2025-41259?
To fix CVE-2025-41259, update SWUpdate to version 2026.05 or later.
3
What type of vulnerability is CVE-2025-41259?
CVE-2025-41259 is a race condition vulnerability.
4
What impact does CVE-2025-41259 have on systems?
CVE-2025-41259 allows unprivileged attackers to escalate privileges to root or install untrusted content.
5
What software is affected by CVE-2025-41259?
SWUpdate before version 2026.05 is affected by CVE-2025-41259.