CVE-2026-35344

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-252

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-353455.3A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name CVE-2026-353463.3The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation use CVE-2026-353474.4The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are CVE-2026-353485.5The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 f CVE-2026-353497.7A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-stri CVE-2026-35359.8The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGV CVE-2026-353506.6The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the CVE-2026-353514.2The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls b CVE-2026-353527.0A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then CVE-2026-353533.3The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived perm CVE-2026-353544.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended a CVE-2026-353556.3The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. Th