The vulnerability in uutils coreutils' split utility arises from a TOCTOU race condition where the program validates file identity by path before opening the output file with truncation. Because the check and the file open are separate operations, an attacker with local write access to the directory can alter the path (e.g., via symbolic links) between these steps. This manipulation can redirect the truncation and write operations to unintended files, including the input file or other sensitive files accessible by the process, causing data loss. The vulnerability requires local access with write permissions and has a medium CVSS score of 6.3, reflecting high impact on integrity and availability but requiring high attack complexity and low privileges.

Successful exploitation can lead to permanent data loss by truncating and overwriting unintended files, including the input file or other sensitive files accessible to the process. This affects data integrity and availability but does not impact confidentiality. The attack requires local access with write permissions to the directory containing the files. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local write permissions on directories where the split utility is used to trusted users only to reduce the risk of exploitation. Avoid running split operations in directories where untrusted users have write access. Monitor vendor channels for updates or patches addressing this TOCTOU vulnerability.