PT-2026-34510 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-05-04 · CVE-2026-35374

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) issue exists in the split utility. The program validates that input and output files are not the same by checking their file paths. After this validation, the utility opens the output file with truncation. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components, such as replacing a path with a symbolic link. This allows the utility to truncate and write to an unintended target file, which could be the input file or other sensitive files, resulting in permanent data loss. TOCTOU is a race condition where a system resource is modified between the time it is checked and the time it is used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-35374

GHSA-4WRP-79M8-9M9P

Affected Products

Uutils Coreutils

References · 11

• https://github.com/uutils/coreutils/pull/11401 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4wrp-79m8-9m9p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35374 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35374 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35374 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35374 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35374 · Security Note
• https://github.com/uutils/coreutils · Note
• https://t.me/cveNotify/162063 · Telegram Post
• https://twitter.com/CVEnew/status/2047012079312527365 · Twitter Post