CVE-2026-5958: Race Condition in GNU Sed
Last updated 27 May 2026
Other sources
When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function opennextfile() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sedto a version that resolves this vulnerability.Fixed in 4.9-1+deb12u1Fixed in 4.9-2+deb13u1Fixed in 4.9-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.9-2 - Upgrade
Upgrade
GNU sedto a version that resolves this vulnerability.Fixed in 4.10Patch CVE-2026-5958
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5958?
CVE-2026-5958 has been assessed with a medium severity due to the potential for race condition attacks.
How do I fix CVE-2026-5958?
To fix CVE-2026-5958, upgrade GNU sed to version 4.10 or later.
What versions of GNU sed are affected by CVE-2026-5958?
GNU sed versions prior to 4.10 are affected by CVE-2026-5958.
What type of issue is CVE-2026-5958 related to?
CVE-2026-5958 is related to a race condition vulnerability involving filesystem operations.
What impact does CVE-2026-5958 have on users?
CVE-2026-5958 can lead to potential data corruption or unintended file modifications for users employing the vulnerable options.