CVE-2026-35374 uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition
A local attacker can exploit a race condition in the split utility to truncate and overwrite arbitrary files, causing permanent data loss.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35374?
CVE-2026-35374 is a medium-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operation. However, the utility subsequently opens the output file with truncation after this path-based validation is complete. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link). This can cause split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.
Weakness: CWE-367
Which versions are affected by CVE-2026-35374?
2 open source packages ship an affected version, including coreutils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
coreutils crates.io | All versions to 0.8.0 | None |
coreutils crates.io | All versions to 0.8.0 | None |
Products include Uutils Coreutils.
How do I fix CVE-2026-35374?
Apply the vendor's patch.
Is CVE-2026-35374 being exploited?
There is no known exploitation of CVE-2026-35374 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35374, GHSA-4wrp-79m8-9m9p, UBUNTU-CVE-2026-35374.