CVE-2026-112907 tox-dev CVE debrief

Who should care

Defenders responsible for Windows systems with filelock versions 3.22.0 through 4.2.0 installed should assess exposure to this vulnerability and prioritize verification and patching.

Why it matters

This vulnerability in the filelock library on Windows allows an oplock on a soft lock's marker to hold SoftFileLock.acquire() past its timeout and block the stale break, potentially leading to a denial-of-service (DoS) condition. Defenders responsible for Windows systems with filelock versions 3.22.0 through 4.2.0 installed should assess exposure to this vulnerability and prioritize verification and patching.

• Defenders must verify the presence of filelock versions 3.22.0 through 4.2.0 on Windows systems.
• Defenders must assess exposure to this vulnerability and prioritize patching.
• Successful exploitation of this vulnerability could lead to a denial-of-service (DoS) condition.

Technical summary

The filelock library on Windows uses oplocks on soft lock markers, which can cause SoftFileLock.acquire() to wait past its timeout and block the stale break. This vulnerability affects filelock versions 3.22.0 through 4.2.0 on Windows. The issue arises when another local account can open the marker for reading, take a Level 1 oplock on it, and leave the break unanswered. This causes every acquire() by the user running the lock to wait inside the open, past its timeout, blocking=False and cancel_check, and a stale marker under that oplock is not broken. Defenders should prioritize verifying the presence of filelock versions 3.22.0 through 4.2.0 on Windows systems and assess exposure to this vulnerability.

Defensive priority

Defenders should prioritize verifying the presence of filelock versions 3.22.0 through 4.2.0 on Windows systems and assess exposure to this vulnerability.

Recommended defensive actions

• Verify the presence of filelock versions 3.22.0 through 4.2.0 on Windows systems
• Assess exposure to this vulnerability
• Apply the patch or upgrade to filelock version 4.2.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the filelock library's use of oplocks on soft lock markers on Windows. An oplock is a request by a process that holds a handle on a file to be told before another process opens, renames or deletes that file. If another local account can open the marker for reading, it can take a Level 1 oplock on it while no process holds it open, and leave the break unanswered. This causes every acquire() by the user running the lock to wait inside the open, past its timeout, blocking=False and cancel_check, and a stale marker under that oplock is not broken.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.