A flaw in the file locking library causes the SoftReadWriteLock component to refresh lock holder records by name. A local user with rename rights to the lock directory can replace a lock holder record with a named pipe, causing the locking process to block, or, if the operating system allows permissive hard‑link creation, link the record to a target file so that subsequent writes are redirected to that file. The outcome is either a denial of service or the accidental modification of an unrelated file by a process that believes it is writing to a lock file.

The vulnerability affects the Python filelock library provided by tox‑dev. Versions from 4.0.0 up through 4.2.1 are susceptible. The fix is available in filelock 4.2.1 and later releases.

The exploit requires local privileges with permission to rename files in the lock directory or to create hard links, so it is a local integrity and availability vulnerability. The CVSS score of 6.1 indicates a moderate threat, and the EPSS score is not available so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV. If an attacker can gain the required local access, they can cause a lock to fail and potentially write unintended data to files via hard‑link manipulation.