What is CVE-2026-93658?

CVE-2026-93658 is a high-severity vulnerability in Uutils Coreutils, classified under Improper Preservation of Permissions. CVSS score: 7.0/10. Published 2026-09-18.

How severe is CVE-2026-93658?

High severity. CVSS v3 base score is 7.0 out of 10.

Vulnerability in Uutils Coreutils

CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Uutils Coreutils

Weakness classification (CWE)

CWE-281 — Improper Preservation of Permissions

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (issue-tracking, patch)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-93658?: CVE-2026-93658 is a high-severity vulnerability in Uutils Coreutils, classified under Improper Preservation of Permissions. CVSS score: 7.0/10. Published 2026-09-18.
How severe is CVE-2026-93658?: High severity. CVSS v3 base score is 7.0 out of 10.