PT-2026-34493 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35357

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The cp utility is subject to an information disclosure race condition. Destination files are initially created using permissions derived from the umask (for example, 0644) before the process restricts them to their final mode (for example, 0600). A local attacker can exploit this timing window to open the file; the resulting file descriptor remains valid and readable even after permissions are tightened, allowing access to sensitive or private content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-35357

GHSA-2M8X-MVFX-GWGJ

Affected Products

Uutils Coreutils

References · 10

• 🔥 https://github.com/uutils/coreutils/issues/10011 · Exploit
• https://ubuntu.com/security/CVE-2026-35357 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35357 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35357 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2m8x-mvfx-gwgj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35357 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35357 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35357 · Security Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012097553551465 · Twitter Post