Dashboard / CVE-2026-112907

CVE-2026-112907

LOW
INFO Priority: 0.00 BB Relevance: 20/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

No Interaction

CVSS Vector Breakdown

AV: Local
AC: High
PR: Low
UI: None
S: Unchanged
C: None
I: None
A: Low

Description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock break. Another local account with read access to an unheld marker can keep a Level 1 or batch oplock unanswered, causing SoftFileLock.acquire and related async or fallback locks to wait beyond timeout, blocking=False, and cancel_check. A stale marker under the oplock cannot be broken, but mutual exclusion remains intact and no file other than the marker is accessed. This issue is fixed in version 4.2.1.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
tox-dev filelock >= 3.22.0, < 4.2.1
tox-dev filelock >= 3.22.0, < 4.2.1

References & Advisories (5)

Bug Bounty Relevance

20 / 100
✓ No user interaction

CVSS Score

2.5 / 10.0 v3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS — Exploitation Probability

0.10%
Raw Score 0.001040
Percentile 1.1%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00104
2026-11-13
0.00104
2026-11-12
0.00104
2026-11-10
0.00104
2026-11-09
0.00104
2026-11-08
0.00104
2026-11-07
0.00104
2026-11-06
0.00104

Intelligence Sources

mitre ref →
nvd ref →

External Links