Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck

CVE-2026-93658uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid

High 7.0

In plain English

A high-severity security flaw in coreutils from uutils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.1%top 96.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rust-coreutils	no fix listed	DEBIAN-CVE-2026-93658
Debian:13	rust-coreutils	no fix listed	DEBIAN-CVE-2026-93658
Debian:14	rust-coreutils	0.10.0-1	DEBIAN-CVE-2026-93658
Ubuntu:24.04:LTS	rust-coreutils	no fix listed	UBUNTU-CVE-2026-93658
Ubuntu:26.04:LTS	rust-coreutils	no fix listed	UBUNTU-CVE-2026-93658

Affected products (as reported)

Vendor	Product	Versions
uutils	coreutils	0.0.18 – before 0.10.0

Weakness: CWE-281 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-cgg3-923w-v53m) vendor-advisory
Pull Request #13629 patch, issue-tracking
Patch Commit patch
Vulnerable install.rs at 0.9.0 technical-description
https://github.com/uutils/coreutils product
VulnCheck Advisory: uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid third-party-advisory