Security researchers from Graz University of Technology in Austria have uncovered significant vulnerabilities within the file notification systems of major operating systems, including Android, Linux, macOS, and Windows. These flaws, some of which have persisted for decades, allow potentially sensitive system information to be leaked.
Decades-Old Bugs Exposed
Sudheendra Raghav Neela, a doctoral student at TU Graz, highlighted that these issues stem from the file-notification subsystems integral to modern operating systems. These subsystems are designed to notify applications when files are accessed or modified, but they inadvertently create side channels that can be exploited by malicious users. The affected systems include:
- inotify on Linux (since 2005)
- FileObserver on Android (since 2008)
- ReadDirectoryChangesW on Windows (since 2000)
- FSEvents on macOS (since 2007)
While these systems do not disclose file contents, the information they provide can be leveraged to infer user activities. For instance, attackers can execute inter-keystroke timing attacks, revealing user input, or conduct website fingerprinting attacks that track online behavior.
Research Findings and Attack Scenarios
In their paper, titled “File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS,” Neela and his colleagues detail various attack scenarios. They note that unprivileged users can access file notification subsystems, allowing them to monitor file events even without explicit read permissions. This poses a significant risk, particularly in environments where multiple users share access to files.
Neela elaborated on the implications of these vulnerabilities, stating, “On Linux, watching a readable directory leaks events on files inside it you cannot even read.” This capability enables attackers to monitor keystrokes with alarming accuracy, achieving a 93.1% to 100% accuracy rate across multiple users.
Vulnerabilities Across Platforms
The researchers identified specific vulnerabilities in various operating systems. For example, the Linux vulnerability (CVE-2025-68788) received a partial fix in December 2025, addressing some issues related to special files. However, the situation remains dire for Android, where the FileObserver can bypass app storage isolation, allowing unauthorized access to sensitive data.
Apple’s macOS, while providing limited information due to a lack of bypasses for private directories, still allows monitoring of various file changes that can expose sensitive user activity. On Windows, the situation is particularly concerning; monitoring the root directory can reveal the full path of every file accessed across all users, enabling real-time tracking of web activity with a 97.8% accuracy rate.
Vendor Responses and Future Mitigations
In response to these findings, Microsoft characterized the issue as “by-design,” a statement that has drawn criticism and was even nominated for the “lamest vendor response” at the Pwnie Awards 2026. The researchers argue that the current protections are insufficient and advocate for more robust mitigations across all major operating systems.
Proposals include disallowing the monitoring of entire drives on Windows and introducing a permission system for file monitoring on both Windows and macOS. The researchers emphasize the need for capability checks to extend to monitoring one’s own files and any readable files, thereby enhancing user privacy and security.
The findings will be presented at the ACM CCS 2026 conference scheduled for November in The Hague, Netherlands, underscoring the urgency of addressing these vulnerabilities in our increasingly interconnected digital landscape.
