High severity7.0NVD Advisory· Published Sep 18, 2026· Updated Sep 18, 2026
CVE-2026-93658
CVE-2026-93658
Description
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rsnvd
- github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55nvd
- github.com/uutils/coreutils/pull/13629nvd
- github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53mnvd
- www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuidnvd
News mentions
0No linked articles in our index yet.