CVE-2026-35355 Details
Description
The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.
A TOCTOU (Time-of-Check to Time-of-Use) race condition vulnerability has been identified in the install utility of uutils coreutils version 0.6.0. The issue arises during file installation, where the utility unlinks an existing file and then recreates it without using the O_EXCL flag. This creates a window of opportunity for a local attacker to exploit the vulnerability by replacing the file with a symbolic link, redirecting privileged writes to overwrite arbitrary system files.
Users can update to uutils coreutils version 0.6.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/10067 | CISA-ADP | ExploitIssue TrackingPatch |
| https://github.com/uutils/coreutils/pull/10067 | [email protected] | ExploitIssue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.6.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.6.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |