A decades-old OS bug can leak what you type
A security weakness hiding in the file-monitoring systems of major operating systems could allow attackers to infer what users are doing, even without being able to access the files themselves.
Researchers at Austria’s Graz University of Technology discovered that the problem affects file-notification mechanisms in Windows, Linux, macOS and Android. These components are designed to tell applications when files change, but they can also expose enough information for attackers to build side-channel attacks.
The underlying flaws aren’t exactly new. Researchers say Windows’ ReadDirectoryChangesW has been affected since around 2000, Linux’s inotify since 2005, macOS FSEvents since 2007, and Android’s FileObserver since 2008.
The researchers demonstrated several potential attacks, including monitoring the timing between keystrokes. On Linux, they were reportedly able to turn file-event notifications into a local keystroke-timing attack with 93.1% to 100% accuracy across seven users, while a remote SSH-based test reached 100% accuracy.
The same information could potentially reveal which websites someone is visiting or contribute to attacks designed to capture login credentials.
The issue exists partly because ordinary, unprivileged users can access file-notification mechanisms. Some shared or readable directories can therefore expose activity involving files the observer cannot actually open.
Despite the findings, operating-system vendors have not rushed to patch the underlying behavior. The researchers notified vendors about a year ago. Linux introduced some mitigations, including changes related to CVE-2025-68788, but they only address part of the techniques described.
Microsoft reportedly considers the behavior of ReadDirectoryChangesW to be by design, while Apple acknowledged the research but apparently made no major changes. That doesn’t mean every Windows, Mac, or Linux user is about to have their passwords stolen. Side-channel attacks are difficult to execute reliably and typically require specific conditions.
