CVE-2026-93658 uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
Attackers can exploit a race condition in uutils coreutils install to retain setuid bits on files, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93658?
CVE-2026-93658 is a high-severity vulnerability in uutils coreutils, published on 18 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
Weakness: CWE-281
Which versions are affected by CVE-2026-93658?
How do I fix CVE-2026-93658?
Upgrade to a fixed version.
Is CVE-2026-93658 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93658 exists.
Sources
Also known as DEBIAN-CVE-2026-93658, GHSA-7xr6-4qqg-jjh9, GHSA-cgg3-923w-v53m, UBUNTU-CVE-2026-93658.