Vulnerabilities · 12h ago

TU Graz Finds Cross-OS File-Event Side Channel

TU Graz researchers disclosed a decades-old file-notification side channel across Linux, Android, Windows, and macOS, with the Linux issue tracked as CVE-2025-68788. The flaw sits in APIs such as inotify, FileObserver, ReadDirectoryChangesW, and FSEvents, which tell software that a file was opened, changed, written, or deleted.

The leak is in the event pattern, not the file contents. A low-privilege process can watch notifications on readable or globally visible paths and infer keystrokes, website visits, and prompt timing from what changes and when, even when it cannot read the file itself. Microsoft’s view that the leak is by design underscores that this is not just a patchable bug on one platform.

For teams that rely on local sandboxing or assume “no read access” means “no visibility,” the exposure survives wherever file-change events are exposed to untrusted code. The Linux fix narrows one implementation, but the cross-OS design problem remains for any app or platform that treats notification access as harmless metadata.

CVE-2025-68788

NVD KEV

EPSS 0.2% (11th percentile).

Timeline

Sep 24 Reported by The Register Security

Sources

1 source covering this story

The Register Security Sep 24
Decades-old file security flaws found in Android, Linux, macOS, and Windows
Security researchers report that Microsoft considers the side-channel leak of file events to be by design

Entities

CVE-2025-68788

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-09-25

Editions

Briefing for 2026-09-25

Vulnerabilities · 12h agoTU Graz Finds Cross-OS File-Event Side ChannelTU Graz researchers disclosed a decades-old file-notification side channel across Linux, Android, Windows, and macOS, with the Linux issue tracked as CVE-2025-68788. The flaw sits in APIs such as inotify, FileObserver, ReadDirectoryChangesW, and FSEvents, which tell software that a file was opened, changed, written, or deleted.The leak is in the event pattern, not the file contents. A low-privilege process can watch notifications on readable or globally visible paths and infer keystrokes, website visits, and prompt timing from what changes and when, even when it cannot read the file itself. Microsoft’s view that the leak is by design underscores that this is not just a patchable bug on one platform.For teams that rely on local sandboxing or assume “no read access” means “no visibility,” the exposure survives wherever file-change events are exposed to untrusted code. The Linux fix narrows one implementation, but the cross-OS design problem remains for any app or platform that treats notification access as harmless metadata.