CVE-2026-35368

CVE-2026-35368 is a privilege escalation vulnerability in uutils coreutils' chroot utility that occurs when the --userspec option is used. The flaw exists because the utility resolves user specifications via getpwnam() after entering the chroot environment but before dropping root privileges, allowing the Name Service Switch (NSS) system on glibc-based platforms to load malicious shared libraries from a writable NEWROOT directory. An attacker with local access and write permissions to the chroot directory can inject a malicious NSS module to execute arbitrary code with root privileges, enabling full container escape or privilege escalation. The vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.8, requiring local access and moderate attack complexity but delivering high impact across confidentiality, integrity, and availability. The attack vector is local with low privilege requirements, though user interaction is not necessary. The EPSS score of 0.00014 indicates minimal current exploitation prevalence compared to other vulnerabilities, though the FAUCET Risk Score of 48.0 suggests moderate concern warranting monitoring. There is no evidence of active exploitation in the wild, and the vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog. Community attention appears minimal given the inactive status on exploit tracking lists and low EPSS prevalence, though the theoretical severity of the vulnerability merits attention from organizations running uutils coreutils in containerized or multi-tenant environments with untrusted users.