A flaw in openSUSE sdbootutil’s handling of temporary directories allows a local user to pre‑create a custom directory that is later used for system‑level operations. By doing so, the attacker can read sensitive data stored in /var/lib/pcrlock.d, corrupt backup data in /tmp/pcrlock.d.bak, or overwrite protected system files through symlinks. The vulnerability stems from an insecure temporary file design (CWE‑377) and can result in data integrity breaches or elevated privileges for the local account.

The issue impacts all versions of the openSUSE sdbootutil utility earlier than commit 5880246d3a02642dc68f5c8cb474bf63cdb56bca. No specific version numbering is provided, so any installation of sdbootutil prior to this commit is vulnerable.

The CVSS score of 7.0 indicates a high severity vulnerability. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers require local system access, meaning this flaw is primarily exploitable by users who already have login privileges. If successfully abused, an attacker can modify or replace protected files and compromise system integrity.