A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations; the final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even when earlier ownership or group changes fail, leading to misinterpretation of success by scripts and administrators. This vulnerability corresponds to CWE-253, which involves incorrect initialization or state.

The vulnerability affects the Uutils coreutils package, specifically the chown and chgrp utilities, present in all releases prior to version 0.6.0. Systems using older installs are susceptible until they apply the update containing the fix.

The CVSS score of 5.5 indicates medium severity. EPSS is not available, suggesting limited exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The risk primarily stems from automated processes misinterpreting success, potentially proceeding with tasks under false assumptions, which could lead to incomplete permission changes, creating security gaps and possibly enabling privilege escalation or data exposure.