A flaw in GLib2’s g_file_replace function creates a race condition when the G_FILE_CREATE_REPLACE_DESTINATION flag is used and the temporary file creation fails. The function removes the target file and recreates it without enforcing exclusive creation or protecting against symlinks. A local attacker who can write to the target directory can exploit the TOCTOU window, unlink the intended file, and replace it with a symbolic link pointing to another file, thereby redirecting subsequent writes to an arbitrary path.

The vulnerability is present in Red Hat’s bundled GLib2 across multiple distributions: Red Hat Enterprise Linux 6 through 10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images. Any system that runs GLib2 and calls g_file_replace with G_FILE_CREATE_REPLACE_DESTINATION in directories writable by less‑privileged users is affected until the vendor releases a patch.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the flaw has not been listed in the CISA KEV catalog, suggesting limited public exploitation. However, the attack only requires local write access on the target directory, which is common, so the risk to environments where processes run as non‑root but can write to shared directories is non‑negligible.