{"cve":"CVE-2026-35354","nvd":{"published":"2026-04-22T17:16:37.867","modified":"2026-10-26T21:10:00.170","status":"Analyzed","description":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":4.7},"cwes":["CWE-367"],"references":["https://github.com/uutils/coreutils/issues/10014","https://github.com/uutils/coreutils/issues/10014"],"products":["uutils:coreutils"],"source":"nvd","synced_at":"2026-10-26T21:38:48.864438205+00:00"},"epss":{"cve":"CVE-2026-35354","score":0.00109,"percentile":0.01231,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-x4mc-mqm7-gg39","url":"https://osv.dev/vulnerability/GHSA-x4mc-mqm7-gg39","summary":"uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition","modified":"2026-09-10T03:50:44.951422969Z","packages":[{"ecosystem":"crates.io","name":"coreutils","purl":"pkg:cargo/coreutils","ranges":["<=0.8.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}