The vulnerability in uutils coreutils mkfifo arises from improper permission assignment (CWE-732). When mkfifo attempts to create a FIFO but finds an existing file at the target path, it does not terminate the operation but proceeds to call set_permissions on the existing file. This results in the existing file's permissions being reset to a default mode (commonly 644 after applying umask), potentially exposing sensitive files to unauthorized access. The flaw affects local users with low privileges (AV:L/PR:L) and does not require user interaction. The impact includes high confidentiality and integrity loss but no availability impact.

The vulnerability can lead to unauthorized modification of file permissions on existing files, potentially exposing sensitive data such as SSH private keys to other local users. This results in a high impact on confidentiality and integrity of affected files. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running mkfifo on paths where files already exist or manually verify file permissions after mkfifo operations to ensure sensitive files are not exposed.