CVE-2025-46327

Status: AnalyzedHigh (7)—

gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 1.13.3.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.14%
Percentile among all scored CVEs: 3
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Primary impactT1565.001 Stored Data Manipulationimpact75 %
Secondary impactT1059 Command and Scripting Interpreterexecution65 %

TOCTOU en verificación de propiedad de archivo de configuración (AV:L, PR:L) permite a atacante local sobrescribir la configuración de logging: escalada de privilegios (T1068) con impactos en manipulación de datos (logs) y potencial ejecución de código a través de ubicación de output controlada.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Restrict File and Directory Permissions Privileged Account Management Remote Data Storage

Affected technologies (1)

Snowflake — Gosnowflake

CWEs

CWE-367

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-46327",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-46327",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-29T13:42:52.917381Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "snowflakedb",
          "product": "gosnowflake",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.7.0, < 1.13.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-28T23:15:44.803",
  "references": [
    {
      "url": "https://github.com/snowflakedb/gosnowflake/commit/ba94a4800e23621eff558ef18ce4b96ec5489ff0",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-6jgm-j7h2-2fqg",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 1.13.3."
    },
    {
      "lang": "es",
      "value": "gosnowflake es el controlador de Snowflake para Golang. Las versiones desde la 1.7.0 hasta la 1.13.3 son vulnerables a una condición de ejecución TOCTOU (Time-of-Check to Time-of-Use). Al usar la función Easy Logging en Linux y macOS, el controlador lee la configuración de registro de un archivo proporcionado por el usuario. En Linux y macOS, el controlador verifica que solo su propietario pueda escribir en el archivo de configuración. Esta comprobación era vulnerable a una condición de ejecución TOCTOU y no verificaba que el propietario del archivo coincidiera con el usuario que ejecutaba el controlador. Esto podría permitir que un atacante local con acceso de escritura al archivo de configuración o al directorio que lo contiene sobrescribiera la configuración y obtuviera el control sobre el nivel de registro y la ubicación de salida. Este problema se ha corregido en la versión 1.13.3."
    }
  ],
  "lastModified": "2026-06-17T09:26:14.517",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:snowflake:gosnowflake:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "192EEE2B-8BF5-492A-9042-C1416DC2DFBC",
              "versionEndExcluding": "1.13.3",
              "versionStartIncluding": "1.7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}