The mv utility in uutils coreutils contains a Time‑of‑Check to Time‑of‑Use race condition that occurs during cross‑device moves. The tool removes the destination path before copying the new file, creating a window where a local attacker can replace the destination with a symbolic link. When mv then performs the privileged move, it follows the symlink and writes the source contents to an arbitrary target file, potentially corrupting or replacing critical data.

The affected product is the mv command in the uutils coreutils package. No specific version information is listed, so any unpatched installation of this utility could be vulnerable.

The CVSS score of 6.3 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation. The attack requires local write access to the destination directory and a cross‑device move, conditions that are common on shared or multi‑user systems. If an attacker gains this capability, they can overwrite arbitrary files, leading to data loss or potential privilege escalation.