CVE-2016-3067: Cygwin

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.

Affected products

• Cygwin Cygwin: up to and including 2.4.1-1

Published 2017-04-21. Last modified 2026-06-17.