The touch command in uutils coreutils can truncate an existing file when a Time‑of‑Check to Time‑of‑Use (TOCTOU) race condition occurs. During file creation, the utility verifies that the target path is missing and later calls File::create(), which internally uses O_TRUNC. An attacker can exploit the window between the check and the use by creating or switching a symbolic link at the target path, causing the touch command to truncate an existing file and permanently erase its data. This weakness corresponds to CWE‑367 and can lead to irreversible loss of critical information.

The affected product is uutils coreutils. No specific version information is supplied, so all releases that include the touch utility are potentially vulnerable until a patch is released.

The CVSS score of 6.3 indicates a medium severity vulnerability. Although the EPSS score is not provided, the risk of exploitation depends on the attacker’s ability to influence file creation paths. The vulnerability is not currently listed in the CISA KEV catalog. It is most likely exploitable in a local environment where the attacker has write permission to the target directory, or remotely if a privileged service runs touch with elevated rights. An attacker with such access could deliberately truncate a file by swapping a symlink at the target path during the race window. The absence of a publicly available patch suggests the need for immediate mitigation to prevent potential data loss.