CVE-2026-35374

CVE-2026-35374 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the split utility of uutils coreutils. The flaw exists because the utility validates that input and output files are different using path comparison, but then opens the output file with truncation after this check completes, creating an exploitable window where an attacker can manipulate symbolic links or path components to redirect writes to unintended targets. The vulnerability requires local access with write permissions to the target directory and has a CVSS score of 6.3 (Medium), reflecting its high impact potential but higher attack complexity and lower privilege requirements. An attacker can permanently corrupt or delete sensitive files, including the input file itself or other files readable by the process, resulting in data loss and potential system compromise. There is currently no evidence of active exploitation or publicly available exploit code. The vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat watch lists. The EPSS score of 0.00012 indicates minimal probability of exploitation in the wild, though the moderate FAUCET Risk Score of 35.0/100 suggests organizations should prioritize patching when updates become available.