CVE-2026-35357

MEDIUM4.7EPSS 0.01%

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

Published: 4/22/2026Modified: 6/2/2026
Also known as:GHSA-2m8x-mvfx-gwgjCGA-99q5-jch4-99c8DEBIAN-CVE-2026-35357

Description

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References (4)