Loading story…
Researchers at Graz University of Technology disclosed decades-old side-channel weaknesses in file-notification mechanisms used by Android, Linux, macOS, and Windows. A local unprivileged user can monitor file-event metadata—not file contents—to infer sensitive activity including keystrokes, website visits, authentication prompts, application usage, and connected-device events. On Linux, the exposure involves the inotify filesystem-event interface, which reports monitored filesystem activity to user-space applications.
Linux received a partial mitigation for CVE-2025-68788 in December 2025, but researchers reported no Android mitigation. Microsoft said the Windows behavior is by design. Organizations should restrict untrusted local code execution and review applications that use broad filesystem monitoring, while platform vendors are urged to enforce stronger permissions or capabilities for file-event monitoring—particularly preventing whole-drive monitoring on Windows.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft's refusal to remediate the Windows filesystem-event behavior was reportedly associated with the 2026 Pwnie Award category for Lamest Vendor Response.
Linux kernel releases 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3 partially addressed CVE-2025-68788. The patch stops generation of access and modify events for special files under /dev/.
Microsoft documented administrator-enableable protections for certain directory-change-notification file-path disclosure scenarios. The guidance predates the Graz University researchers' disclosure of the broader cross-user Windows file-event behavior.
Researchers from Graz University of Technology disclosed file-notification information-leakage findings to the Linux, Android, Windows, and macOS security teams between August and October 2025.
The CCS 2026 research-artifact repository documented additional proofs of concept, including inferring WhatsApp media arrivals on Android, Firefox browsing origins on Windows, and application installations or removals through macOS FSEvents. It also provided a deliberately vulnerable Debian VM for controlled validation of Linux inotify attacks.
The researchers reported that Android had not appeared to mitigate FileObserver's ability to bypass per-application FUSE storage isolation and expose metadata from private application folders.
Microsoft told the researchers that Windows reporting full file paths while monitoring the C:\ root directory, regardless of permissions and users, was undocumented behavior by design.
Graz University of Technology researchers identified side-channel flaws in Linux inotify, Android FileObserver, Windows ReadDirectoryChangesW, and macOS FSEvents that allow local users to infer sensitive activity from file-event metadata. Demonstrated attacks included keystroke timing, website fingerprinting, and credential-theft UI redress attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceopennet.ru
Open sourcecyberveille.ch
Open sourcetheregister.com
Open sourceman7.org
Open sourceman7.org
Open sourceinoti.fyi
Open sourceinoti.fyi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security updates for a broad set of **information disclosure vulnerabilities** affecting Windows components including the **Windows Kernel**, **Secure Kernel Mode**, **Storage Port Driver**, **Kerberos**, **File Explorer**, **Push Notification**, and **Storage Spaces** features. The referenced advisories identify numerous CVEs, including `CVE-2025-21319`, `CVE-2025-21323`, `CVE-2025-21242`, `CVE-2025-32722`, `CVE-2025-49684`, `CVE-2025-48808`, `CVE-2025-48809`, `CVE-2025-48810`, `CVE-2025-26636`, `CVE-2025-55683`, `CVE-2025-59184`, `CVE-2025-59209`, `CVE-2026-32217`, and `CVE-2026-32218`, along with earlier related issues such as `CVE-2024-49082` and `CVE-2022-21877`. The disclosures show a recurring pattern of sensitive data exposure risks in core Windows subsystems, with repeated findings in kernel and storage-related code paths. While the individual entries provide limited public detail, the breadth of affected components indicates that enterprises should prioritize Microsoft security updates for systems running Windows workloads that rely on low-level kernel, storage, authentication, and user-interface services, as these flaws could allow attackers to obtain information that may aid further compromise.
Jun 29, 2026
Microsoft disclosed **"Dirty Stream"**, a path traversal-related vulnerability pattern in Android apps that accept shared files from other apps and trust filenames supplied by remote content providers. The flaw can let a malicious app overwrite files inside a target app’s private directory, creating paths to **arbitrary code execution**, theft of authentication tokens, and exposure of other sensitive data. Microsoft said the issue affected multiple popular Google Play apps with a combined install base exceeding **4 billion**. Microsoft highlighted vulnerable apps including **Xiaomi File Manager** and **WPS Office**, and demonstrated code execution in Xiaomi File Manager. The company said exploitation could also expose stored **SMB** and **FTP** credentials and enable access to local network shares beyond the device itself. Microsoft coordinated fixes with affected developers by February 2024 and worked with Google on developer guidance for safer Android file-sharing implementations, reinforcing the need for apps handling shared content to validate filenames and file paths before writing data.
Aug 15, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026