CVE-2026-35359 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils. It allows an attacker with concurrent write access to bypass the intended no-dereference protection on symbolic links. The vulnerability arises because the utility checks if a source path is a symbolic link using metadata but then opens the path without the O_NOFOLLOW flag, enabling a race condition. This can lead to copying contents of arbitrary sensitive files to attacker-controlled destinations.