CVE-2026-35350 — Vulnerability in coreutils — CVE Details

MEDIUM

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

Published April 22, 2026Updated September 10, 2026Source: osv

Summary

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Advisory Timeline

First published April 22, 2026 (173 days ago).
Last revised September 10, 2026 — 140 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
coreutils	crates.io	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-281
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.6 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

https://nvd.nist.gov/vuln/detail/CVE-2026-35350
ADVISORY
https://github.com/uutils/coreutils/issues/9750
WEB
https://github.com/uutils/coreutils
PACKAGE

Frequently Asked Questions

What is CVE-2026-35350?: uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.6/10).
How do I check if my project is affected by CVE-2026-35350?: CVE-2026-35350 affects coreutils. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-35350 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.6

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-x2wv-9p67-mh9w

Related CVEs

CVE-2026-35352
HIGH
uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition
CVE-2026-35368
HIGH
uutils coreutils has an Untrusted Search Path
CVE-2026-102821
MEDIUM
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
CVE-2026-35374
MEDIUM
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-102820
MEDIUM
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
CVE-2026-35364
MEDIUM
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-35360
MEDIUM
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies