Privilege Escalation Vulnerability in uutils Coreutils by uutils

CVE-2026-35350

What is CVE-2026-35350?

The cp utility within uutils coreutils is prone to a security flaw that inadequately manages setuid and setgid bits when attempts to preserve ownership fail. When utilizing the -p (preserve) flag, it retains the mode bits from the source, even if the ownership change fails. This oversight can lead to a scenario where a user-owned copy of a file maintains privileged mode bits, potentially resulting in unauthorized execution of privileged commands that breach local security protocols. Unlike GNU cp, which rectifies this by clearing such bits when ownership preservation is not possible, uutils coreutils exhibits this vulnerability, prompting substantial security concerns.

References