CVE-2026-35355 describes a TOCTOU race condition in the install utility of uutils coreutils. The vulnerability occurs because the utility removes an existing destination file and then recreates it without the O_EXCL flag, which would prevent race conditions. This allows a local attacker to replace the file path with a symbolic link in the time window between unlinking and file creation, potentially redirecting privileged writes to arbitrary system files. The vulnerability requires local access and high attack complexity, with low privileges needed and no user interaction. The impact includes integrity and availability loss but no confidentiality impact. There is no vendor advisory or patch information available at this time.

A local attacker with low privileges can exploit this race condition to overwrite arbitrary system files by redirecting privileged writes through symbolic link manipulation. This can lead to integrity and availability impacts on the affected system. Confidentiality is not impacted. The attack complexity is high, and no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running the vulnerable install utility in untrusted environments or with elevated privileges. Monitor vendor communications for updates on patches or mitigations.