What is CVE-2010-0436?

CVE-2010-0436 is a vulnerability in KDE Sc, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2010-04-15.

Is CVE-2010-0436 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in KDE Sc

CVE-2010-0436

Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.

Vulnerability class: Race Condition

Published 2010-04-15 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 6.9 (Medium). Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.003 (18.3th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

KDE Sc — versions 3.5.10, 4.3.0, 4.4.1

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

Public proof-of-concept exploits

c-skills/CVEs

References

lists.fedoraproject.org/pipermail/package-announce/2010-April/039533.html (vendor-advisory)
lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html (vendor-advisory)
rhn.redhat.com/errata/RHSA-2010-0348.html (vendor-advisory)
secunia.com/advisories/39419 (third-party-advisory, Vendor Advisory)
secunia.com/advisories/39481 (third-party-advisory)
secunia.com/advisories/39506 (third-party-advisory)
www.debian.org/security/2010/dsa-2037 (vendor-advisory)
www.kde.org/info/security/advisory-20100413-1.txt (Vendor Advisory)
www.securityfocus.com/bid/39467 (vdb-entry)
www.vupen.com/english/advisories/2010/0879 (Patch, vdb-entry, Vendor Advisory)

Frequently asked questions

What is CVE-2010-0436?: CVE-2010-0436 is a vulnerability in KDE Sc, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2010-04-15.
Is CVE-2010-0436 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.