uutils coreutils CVE-2026-35339

Exploitation requires three concurrent conditions: (1) uutils coreutils version 0.5.x or earlier must be installed and in use, typically via deliberate substitution or unusual distribution choice since GNU coreutils is standard on most Linux systems; (2) chmod must be invoked in recursive mode (-R flag) against a directory tree with multiple files; (3) at least one file in the traversal must encounter an error (permission denied, read-only filesystem, etc.) on an earlier file, while the final file processed succeeds. The vulnerability does NOT manifest if all files are processed successfully or if all fail-it specifically requires mixed success/failure outcomes. Non-recursive chmod (single-file or implicit single-level mode) is not affected. No special network access, authentication bypass, or default misconfiguration is required; the flaw is inherent to the recursive implementation.

This vulnerability presents moderate real-world risk despite a CVSS score of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) correctly reflects local attack vector and high integrity impact, but the practical threat depends heavily on deployment context. SSVC decision framework classifies this as non-exploitable in the traditional sense (Exploitation: none), non-automatable (requires local privileged or user-level access and a script relying on exit codes), and partial technical impact. The vulnerability is a logic flaw, not a memory corruption or code execution vector, limiting offensive potential. However, integrity impact is HIGH because automated permission-setting scripts-common in system administration, containerization, and configuration management-may silently fail to enforce intended access controls. The risk is elevated in CI/CD pipelines, infrastructure-as-code deployments, and privileged automation where humans do not manually verify chmod success. Organizations using uutils coreutils in place of GNU coreutils should prioritize patching. The vulnerability is NOT actively exploited in the wild (no KEV status, no public POC identified), reducing urgency but not eliminating it.

A system administrator deploys an automated script that recursively changes permissions on a sensitive directory (e.g., chmod -R 0600 /etc/secrets) as part of a hardening playbook. The script checks only the exit code returned by chmod. On some files, the operation fails due to filesystem constraints or permission denials on the parent directory, but because the last file processed succeeds, chmod returns exit code 0. The script completes without error notification, and subsequent log review or compliance audits discover that critical files retain world-readable permissions, exposing sensitive data.