{"id":"EUVD-2026-24990","revision":"153236030a8b4fc6aa47878d5ec9449b","records":[{"revision":"153236030a8b4fc6aa47878d5ec9449b","observedAt":"2026-10-28T04:55:08.562+00:00","statement":{"source":"euvd","id":"EUVD-2026-24990","aliases":["CVE-2026-35354"],"title":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to…","description":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","score":4.7,"severity":null}],"references":["https://github.com/uutils/coreutils/issues/10014"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24990","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 22, 2026, 4:08:12 PM","dateUpdated":"Apr 22, 2026, 6:02:57 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24990","identifiers":["EUVD-2026-24990","CVE-2026-35354"]},"retained":false,"historicalAffected":[]}],"coverage":[]}