CVE catalog

CVE-2026-46607

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible pat

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 25, 2026

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker with write access to that path — through any of several realistic local or container-level scenarios — can plant a malicious pickle file and achieve arbitrary code execution as the OS user running Glances the next time it starts with version checking enabled (the default). This vulnerability is fixed in 4.5.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglancessid4.5.8+dfsg-1fixed
Debianglancesforky4.5.8+dfsg-1fixed
Debianglancestrixie4.3.1+dfsg-1vulnerable
Debianglancesbookworm3.3.1.1+dfsg-1vulnerable
CpeglancesNot reportedNot reportedvulnerable
PyPIglancesNot reported4.5.5fixed
Ubuntuglancespro3.1.0-1vulnerable
Ubuntuglancespro3.1.1-1vulnerable
Ubuntuglancespro3.1.3-1vulnerable
Ubuntuglancespro3.1.3-1ubuntu0.1~esm1vulnerable
Ubuntuglances22.043.1.5-1vulnerable
Ubuntuglances22.043.2.3.1+dfsg-1vulnerable
Ubuntuglances22.043.2.4.2+dfsg-1vulnerable
Ubuntuglances24.043.4.0.3+dfsg-1vulnerable
Ubuntuglances25.104.3.0.8+dfsg-1vulnerable
Ubuntuglances25.104.3.1+dfsg-1vulnerable
Ubuntuglances26.044.3.1+dfsg-1vulnerable
Ubuntuglances26.044.3.3+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglancessourcesid4.5.5+dfsg-1not yet assignedNot reportedNot reported
Debianglancessourceforky4.5.5+dfsg-1not yet assignedNot reportedNot reported
Debianglancessourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianglancessourcebookworm(unfixed)not yet assignedNot reportedNot reported
PyPIglancesPyPINot reported4.5.5Not reportedPYSEC-2026-2496Not reported

Notes

[trixie] glances: Minor issue [bookworm] glances: Minor issue; outdated.py _load_cache pickle.load of cached glances-version.db present; requires local cache write

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [glances]Affected
    Details (2)

    • 3.3.1.1+dfsg-1 · all · bookworm

      Affected

      nvd · glances · debian · bookworm; nvd · glances · debian · 12

    • 3.3.1.1+dfsg-1 · all · bookworm

      Affected

      nvd · glances · debian · bookworm; nvd · glances · debian · 12

  • [glances-doc]Affected

    Source package: [glances]

    Details (2)

    • 3.3.1.1+dfsg-1 · all · bookworm

      Affected

      nvd · glances · debian · bookworm; nvd · glances · debian · 12

    • 3.3.1.1+dfsg-1 · all · bookworm

      Affected

      nvd · glances · debian · bookworm; nvd · glances · debian · 12

[Debian 13 (Trixie)]

  • [glances]Affected
    Details (2)

    • 4.3.1+dfsg-1 · all · trixie

      Affected

      nvd · glances · debian · 13

    • 4.3.1+dfsg-1 · all · trixie

      Affected

      nvd · glances · debian · 13

  • [glances-doc]Affected

    Source package: [glances]

    Details (2)

    • 4.3.1+dfsg-1 · all · trixie

      Affected

      nvd · glances · debian · 13

    • 4.3.1+dfsg-1 · all · trixie

      Affected

      nvd · glances · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]