TOCTOU Vulnerability in uutils coreutils Split Utility

CVE-2026-35374

What is CVE-2026-35374?

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the split utility of uutils coreutils. Although the utility conducts an initial validation of input and output files based on their paths to prevent data loss, it subsequently opens the output file with truncation once this validation is complete. This creates a race condition that a local attacker with write access to the directory can exploit by modifying the file paths, such as substituting a path with a symbolic link. As a result, the split utility may inadvertently write to unexpected files, including sensitive data or the original input file, which can lead to irreversible data loss.

References