CVE-2025-46326

HIGH Year: 2025
CVSS v3 Score
7.0
High
Weakness Type
CWE-367
View all →

Vulnerability Description

snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Connector reads logging configuration from a user-provided file. On Linux and macOS, the Connector verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Connector. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 4.4.1.

Related Vulnerabilities

CVE-2019-10486

HIGH
CVSS:7.0(High)

Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in Snapdragon Auto, Snapdragon Consumer Electronics Connectivit...

CWE-3672019

CVE-2019-14119

HIGH
CVSS:7.0(High)

u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition and lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon...

CWE-3672019

CVE-2019-15316

HIGH
CVSS:7.0(High)

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to lev...

CWE-3672019

CVE-2020-0204

HIGH
CVSS:7.0(High)

In InstallPackage of package.cpp, there is a possible bypass of a signature check due to a Time of Check/Time of Use condition. This could lead to local escalation of privilege by allowing a bypass of...

CWE-3672020

CVE-2020-0238

HIGH
CVSS:7.0(High)

In updatePreferenceIntents of AccountTypePreferenceLoader, there is a possible confused deputy attack due to a race condition. This could lead to local escalation of privilege and launching privileged...

CWE-3672020

CVE-2020-11233

HIGH
CVSS:7.0(High)

Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdrag...

CWE-3672020