uutils coreutils CVE-2026-35341

Requires authenticated local access to a system running vulnerable uutils coreutils (PR:L from CVSS vector). Exploitation succeeds when mkfifo is invoked (by attacker, victim, or automated process) against a path where a target file already exists. The attacker needs either: (1) ability to control mkfifo invocation directly, (2) ability to manipulate paths used by scripts/applications that call mkfifo, or (3) ability to create symbolic links in directories where mkfifo will be invoked, redirecting operations to sensitive files. Most effective on multi-user systems where users share a filesystem namespace. Single-user systems or containerized environments with isolated filesystems have reduced risk. Systems using GNU coreutils instead of uutils coreutils are not affected-this specifically limits exploitation to environments that have adopted the Rust reimplementation, which is less common than GNU coreutils in production.

Real-world risk is moderate-to-high for multi-user systems but requires specific conditions. CVSS 7.1 (High) reflects local vector (AV:L) with low complexity (AC:L) and low privileges required (PR:L), indicating any authenticated local user can exploit this. The impact is significant: high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N). CISA SSVC framework rates this as 'total' technical impact with proof-of-concept availability but not automatable, requiring targeted exploitation. The CVSS vector indicates no user interaction required (UI:N), making scripted exploitation feasible. However, exploitation requires the attacker to: (1) know or guess the path of a sensitive file, (2) have write access to the parent directory or ability to create symlinks, and (3) trick the victim or system into running mkfifo against that path. The absence of CISA KEV listing and low immediate weaponization suggests this is not yet exploited in the wild, though the POC existence (confirmed by SSVC and GitHub issue #10020) means defenders should treat this as a real threat on shared systems. The 'Information Disclosure' tag understates the risk-this is fundamentally a permission manipulation vulnerability that enables both information disclosure AND privilege escalation paths when combined with other attack vectors.

An authenticated attacker on a shared Linux system identifies that a target user stores SSH private keys at /home/victim/.ssh/id_rsa with restrictive 600 permissions. The attacker creates a working directory where they have write access and uses a race condition or social engineering to cause mkfifo to be invoked (either directly or through a script) targeting the victim's private key path. When mkfifo fails due to the file already existing, it inadvertently changes the key's permissions to 644, making it world-readable. The attacker then reads the now-exposed private key, enabling SSH access to remote systems where the victim has accounts. Proof-of-concept code exists per SSVC assessment, lowering the technical barrier for exploitation.