The cp utility in uutils coreutils incorrectly treats character and block device nodes as stream sources during recursive copies, overwriting them with regular files and destroying device semantics; this flaw can cause disk exhaustion or process stalls, leading to a runtime denial of Service (CWE‑706).

The vulnerability affects the uutils coreutils package, with versions prior to the 0.7.0 release likely impacted; the fix was introduced in the 0.7.0 release noted in the reference links.

The CVSS score of 4.4 indicates moderate severity and the EPSS score of 0.00012, indicating a very low likelihood of exploitation; the vulnerability is not listed in CISA KEV. Attackers could exploit this by running cp -R on directories that include device nodes, which may be feasible for any user with file creation privileges. Given the lack of remote execution vectors, mitigation focuses on version updates or careful use of the tool to avoid copying device nodes.