SecuriTricks - CVE-2026-35355

Description

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.

Product(s) Impacted

Vendor	Product	Versions
Uutils	Coreutils	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	uutils	coreutils	/	/	/	/	/	/	/	/

References

https://github.com/uutils/coreutils/pull/10067

https://github.com/uutils/coreutils/releases/tag/0.6.0

https://github.com/uutils/coreutils/pull/10067

CVSS Score

6.3 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

View Vector String

Timeline

Published: April 22, 2026, 5:16 p.m.
Last Modified: April 22, 2026, 9:23 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-35355