CVE-2026-35350

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-353514.2The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls b CVE-2026-353527.0A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then CVE-2026-353533.3The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived perm CVE-2026-353544.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended a CVE-2026-353556.3The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. Th CVE-2026-353566.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command CVE-2026-353574.7The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with u CVE-2026-353585.5The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sou CVE-2026-353594.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference inte CVE-2026-35368.8Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acc CVE-2026-353606.3The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the CVE-2026-353614.4The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context