CVE-2026-35357

OVERVIEW CVE-2026-35357 is an information disclosure vulnerability in the cp utility within uutils coreutils. The flaw stems from a race condition during file copying where destination files are initially created with permissive umask-derived permissions (such as 0644) before being restricted to their final, more secure mode (such as 0600). This timing window allows a local attacker to open and obtain a file descriptor for the destination file, which remains readable even after the permissions are subsequently tightened, thereby exposing sensitive or private file contents. SEVERITY The vulnerability requires local access with low privileges and is categorized as CVSS 4.7 MEDIUM severity. Exploitation demands relatively high attack complexity, as the attacker must successfully race the permission change window. The attack vector is local only, and there are no integrity or availability impacts; the sole concern is confidentiality. The vulnerability permits reading of sensitive files that would otherwise be protected, making it relevant in multi-user or shared system environments where privilege separation is critical. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild. The EPSS score of 0.000090 indicates this vulnerability ranks extremely low among all CVEs in terms of real-world exploitation probability. No public exploit code is documented, and the vulnerability does not appear on the KEV catalog or CISA's Hot List, suggesting minimal community attention and exploitation activity at this time.