A race condition vulnerability exists in the cp utility of uutils coreutils (CVE-2026-35357). During file copying, destination files are initially created with default permissions before being restricted to their final mode. A local attacker can exploit this timing window to open and read the file descriptor before permissions are tightened, potentially exposing sensitive file contents.