CVE-2026-93658

EUVD-2026-82940
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
uutilscoreutils
0.0.18 ≤
𝑥
< 0.10.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-coreutils
bookworm
vulnerable
forky
0.10.0-1
fixed
sid
0.12.0-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/uutils/coreutils
https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs
https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55
https://github.com/uutils/coreutils/pull/13629
https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m
https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid
https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m