CVE-2026-93658

EUVD-2026-82940
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 3.24%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
uutilscoreutils
0.0.18 ≤
𝑥
< 0.10.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-coreutils
bookworm
postponed
forky
0.12.0-1
fixed
sid
0.12.0-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
rust-coreutils
jammy
dne
noble
needs-triage
resolute
needs-triage
stonking
not-affected
Common Weakness Enumeration
References
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs
https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55
https://github.com/uutils/coreutils/pull/13629
https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m
https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid
https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m