The split utility checks that the input and output files do not share the same file path before starting the split operation. The check, however, is performed before the output file is opened with truncation, creating a race window. A local attacker who can write to the directory may change a path component such as a symbolic link during that window. This can cause split to truncate and write to an unintended target file, including the input file itself or any other file the process can access, resulting in permanent data loss.

Uutils coreutils, specifically the split component, is affected. No specific version information is provided, so all released versions that include split are potentially vulnerable until the patch is applied.

The CVSS score of 6.3 indicates a moderate risk, but the absence of an EPSS score and its non–appearance in the KEV catalog mean it has not yet been observed in the wild. The flaw is exploitable by an attacker with local write access to the directory containing the input and output files, which is common on many systems. The direct impact is data truncation and loss, which can compromise critical data or system integrity.