CVE-2026-18477

Assessment

Why it matters

EPSS is 0.1%; technical severity is CVSS 4.4.

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

Who should care

• Teams operating Tar, Enterprise Linux, Openshift Container Platform
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Tar, Enterprise Linux, Openshift Container Platform is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Red Hat Security advisory RHSA-2026:49361
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-367

Affected versions

GNU Tar (Version 1.35); Redhat Enterprise Linux (Version 8.0 | Version 9.0 | Version 10.0); Redhat Openshift Container Platform (Version 4.0)

Fixed versions

No explicit fixed version is currently recorded.

Published

3 August 2026

Attack vector

Local

Privileges required

Low

User interaction

Required

Signal timeline

1. 3 Aug 2026CVE published
2. 20 Aug 2026Latest EPSS score: 0.1%
3. 19 Aug 2026 · 13:55 UTCSignal calculated at 8