CVE-2026-112913
Description
A flaw was found in filelock. When a lock database is placed in a shared directory writable by other local users on Windows, an attacker can create crafted SQLite side files adjacent to the database. This manipulation causes subsequent lock acquisition attempts to fail immediately, resulting in a denial of service (DoS). Under specific conditions, this behavior may also trigger SQLite recovery to delete an arbitrary file accessible to the user acquiring the lock.
Statement
This vulnerability is rated as Low severity because it requires local access on Windows environments, which are not typical deployment targets for Red Hat products. The flaw occurs when shared directories allow unprivileged local accounts to pre-create auxiliary database files, disrupting lock acquisition or triggering targeted file deletion during recovery. Because Red Hat platforms operate on Linux architectures where filelock uses POSIX locking mechanisms rather than the vulnerable Windows code path, standard enterprise deployments are not exposed to this behavior.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | 3.3 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other)
When an attacker can control a lock, the program may wait indefinitely until the attacker releases the lock, causing a denial of service to other users of the program. This is especially problematic if there is a blocking operation on the lock.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
