The cp utility in the Uutils coreutils package copies files by first creating the destination file with permissions derived from the process umask, then later changing the file mode to the desired value. During this brief window an attacker with local access can open the file before the mode is adjusted. Because the file descriptor remains valid and readable after the permissions are tightened, the attacker can read the file’s contents that were not intended to be exposed. This race condition results in a local information disclosure that can expose sensitive or private data stored by the user performing the copy.

The vulnerability affects the Uutils coreutils package on any environment that uses its cp command. No specific version ranges are listed, so any installation of the package that has not applied the upstream fix is considered vulnerable.

The CVSS score of 4.7 indicates a moderate severity. EPSS information is unavailable, and the issue is not currently on CISA’s KEV list. The attack requires local user privileges and the ability to race with the cp process, making the exploit practical for an attacker who can run commands on the same system. Once executed, the attacker can read the contents of the target file despite the final permissions being set to a more restrictive mode.