Search/CVE-2026-112935
● CVE — Medium

CVE-2026-112935

Vendortox-devProductfilelockDiscoveredOct 20, 2026UpdatedOct 28, 2026

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.

CVSS v3.1
4.7 MEDIUM
EPSS
0.13%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Oct 23, 2026 → Oct 26, 2026
▲ 0.04pp
0.10% → 0.13% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Connections
2 relationships
Timeline
disclosure → media coverage
Oct 20, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 28, 2026