CVE-2026-35357 describes a TOCTOU race condition vulnerability in the cp utility of uutils coreutils. When copying files, the destination file is first created with permissions derived from the system umask (e.g., 0644), then later adjusted to the intended restrictive permissions (e.g., 0600). During this interval, a local attacker can race to open the file descriptor, which remains valid and readable even after permissions are tightened. This allows unauthorized reading of sensitive or private file contents. The vulnerability requires local access and high attack complexity, with no user interaction needed. The vendor has not provided a patch or official remediation at this time.

The vulnerability allows a local attacker to read sensitive file contents by exploiting a race condition in file permission setting during the copy operation. Confidentiality is impacted due to potential unauthorized disclosure of private data. Integrity and availability are not affected. The attack requires local privileges and is of medium severity (CVSS 4.7). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the cp utility from uutils coreutils in untrusted local environments or restrict local user access to trusted users only. Monitor vendor channels for updates or official patches addressing this race condition.