The mkfifo utility in uutils coreutils contains a Time‑of‑Check to Time‑of‑Use race condition. A local attacker with write access to the parent directory can create a FIFO, then replace it with a symlink before the subsequent chmod operation completes, causing the chmod to affect an arbitrary file. This can allow an attacker to change permissions of critical files when mkfifo is executed with elevated rights, resulting in privilege escalation.

The affected product is uutils coreutils. No specific version numbers are listed, so all current releases prior to the fix are potentially impacted.

The vulnerability scores a CVSS of 7, indicating moderate to high risk. EPSS score of <1% (approximately 0.0001) indicates a very low probability of exploitation. The vulnerability is not in the CISA KEV catalog. The likely attack vector is local; an attacker must have write permission in the target directory. Exploitation requires the utility to run with elevated privileges, such as a set‑uid wrapper or a cron job, making host compromise a real threat under those conditions.