The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.
References
| Link | Resource |
|---|---|
| https://github.com/uutils/coreutils/pull/10067 | Exploit Issue Tracking Patch |
| https://github.com/uutils/coreutils/releases/tag/0.6.0 | Release Notes |
| https://github.com/uutils/coreutils/pull/10067 | Exploit Issue Tracking Patch |
Configurations
History
27 Apr 2026, 12:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Uutils
Uutils coreutils |
|
| CPE | cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:* | |
| References | () https://github.com/uutils/coreutils/pull/10067 - Exploit, Issue Tracking, Patch | |
| References | () https://github.com/uutils/coreutils/releases/tag/0.6.0 - Release Notes |
22 Apr 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/uutils/coreutils/pull/10067 - |
22 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 17:16
Updated : 2026-04-27 12:27
NVD link : CVE-2026-35355
Mitre link : CVE-2026-35355
CVE.ORG link : CVE-2026-35355
JSON object : View
Products Affected
uutils
- coreutils
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition