Privasys Remote Attestation TLS Clients performs attestation only once when the connection is established. An attacker with local access can modify workload code, data, or configuration after a successful connection and before the connection is terminated, creating a TOCTOU window. This allows the app to believe the verified evidence remains current while the real state has changed, enabling tampering of the workload at runtime.

Affected product: Privasys ra-tls-clients, any version earlier than 0.9.1. The vulnerability applies to all language utilities provided by this client library. No specific CPE strings or product subcomponents are listed, so all pre‑0.9.1 releases are at risk.

CVSS score is 7.2, indicating high severity. EPSS is not available, and the CVE is not listed in KEV. Exploitation requires local access; the attacker must be able to run code on the same host as the client to modify its state while a handshake is in progress. Because the flaw originates from a temporal race condition (CWE‑367), there is no network‑based attack vector; it is a local privilege or local user security issue. Given the high CVSS, operators should treat this as a serious risk until the issue is corrected.