CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero.

Security readout for executives and security teams

GNU Guile could briefly set a process-wide file-permission setting to fully open while creating directories. In multithreaded applications, another thread could create files or directories during that window with permissions that are too permissive. The issue is fixed in Guile 2.0.13; earlier versions are reported affected. Exposure is most likely in systems running GNU Guile 2.0.12 or earlier, especially multithreaded Guile applications or services that create files or directories while other threads run. Treat as a targeted hygiene fix, not an emergency. Patch where Guile is present, with higher priority for multithreaded services handling sensitive files or shared directories. Mitigation focus: Upgrade GNU Guile to 2.0.13 or a vendor-patched package.; Prioritize multithreaded services that create files or directories through Guile.; Review Fedora or distribution advisories for backported package fixes..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.