The vulnerability in uutils coreutils' install utility involves a TOCTOU race condition triggered by the use of the -D flag. The process of creating parent directories and subsequently resolving the target file path occurs in two separate operations that are not securely anchored, enabling an attacker who can write concurrently to swap a path component with a symbolic link. This can cause privileged writes to be redirected to unintended locations in the filesystem, potentially leading to unauthorized file modification or privilege escalation. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Successful exploitation allows an attacker with concurrent write access to redirect privileged file writes to arbitrary filesystem locations, potentially modifying or overwriting critical files. This can lead to integrity and availability impacts on the affected system. Confidentiality is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using the install utility with the -D flag in environments where untrusted concurrent write access is possible. Monitoring vendor communications for updates is recommended.